Tagged “cve.org”
CVEs tagged cve.org, newest first.
46469 CVEsRSS
CVE-2026-120953Medium· 4.3Atlas SQL JDBC Driver <=4.0.0: OIDC discovery endpoints not scheme-validated - attacker-controlled URI dispatched to OS protocol handler
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating …
CVE-2026-63478Medium· 5.3PoCisomorphic-git: Path traversal via a ".." tree-entry name writes files outside the working directory on clone/checkout
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. D…
CVE-2026-105822High· 8.3Server-Side Request Forgery in Tapo Cloud MQTT Proxy
The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a user-controlled host value without sufficient input validation. An attacker may exploit this vulnerability to cause the Tapo Cloud…
CVE-2026-110826Medium· 6.3AshAuthentication log_out_everywhere leaves sessions valid after a password reset or non-atomic password change
Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication allows an attacker holding a victim's session token to stay signed in after the victim resets or changes their password…
CVE-2026-105821High· 8.3Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy
The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo devices to request service tokens. The broker does not verify that the device ID supplied in a proxy request belongs to…
CVE-2026-63499Medium· 6.9PoCzt-zip: ZipUtil.unpack can change file permissions of output directory
zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.1, ZipUtil.unpack(...) can apply stored ZIP-entry permissions to the extraction output directory when an entry name such as / or ./ re…
CVE-2026-63198High· 7.3traQ: Privilege escalation by OAuth prompt=none request
traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope …
CVE-2026-63502High· 8.3Yeti: Path traversal in ExportTask name allows authenticated arbitrary file read and write
Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Prior to 2.5.1, YETI derives ExportTask.file_name from the user-controlled task name and passes it to core/clients/file_…
CVE-2026-121382High· 7.5Netcore NBR100V2 auto_ac msg_aes_dec integer overflow
A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possib…
CVE-2026-116845Medium· 5.4PoCNetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView
NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows authenticated users to bypass view permissions on parent devices and virtual machines. Attackers with add-component perm…
CVE-2026-93325High· 7.30dayBake filesystem entitlement consent is skipped under --progress=rawjson in Docker Buildx
Buildx bake requires the user to grant entitlements with --allow or an interactive prompt before a build reaches outside the working directory. Under --progress=rawjson that consent step is skipped.
CVE-2026-63470Critical· 9.3PoCfastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple qu…
CVE-2026-99253Noneio_uring/cancel: rearm local work wake up before sleep
In the Linux kernel, the following vulnerability has been resolved: io_uring/cancel: rearm local work wake up before sleep io_uring_try_cancel_requests() sets ->cq_wait_nr to 1 so that the next io_req_local_work_add() wakes the cancell…
CVE-2026-99269High· 7.8sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.deq…
CVE-2026-63471Critical· 9.3PoCfastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embed…
CVE-2026-99246High· 8.1tipc: protect node reset trace dump with node lock
In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipc_node_reset_links trace event asks tipc_node_dump() to walk the node's link entries. Unlike the other node e…
CVE-2026-63469Critical· 9.3fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python …
CVE-2026-99270High· 8.1tcp: Fix potential UAF in reqsk_timer_handler().
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label an…
CVE-2026-99261Nonedrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction It fixes both the move overflow and the eviction fence add for evicting these per-vm BOs.
CVE-2026-99260Nonentfs: fix resident conversion in ntfs_new_attr_flags
In the Linux kernel, the following vulnerability has been resolved: ntfs: fix resident conversion in ntfs_new_attr_flags When setting sparse/compressed flags on a resident attribute, the function skipped the resident-to-non-resident co…
CVE-2026-99255Noneio_uring/io-wq: don't hide a link from cancellations
In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. io_uring_cancel_generic() looks ever…
CVE-2026-99244Nonepid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDI…
CVE-2026-99254Noneio_uring: don't flood a cancelling task with task_work
In the Linux kernel, the following vulnerability has been resolved: io_uring: don't flood a cancelling task with task_work io_ring_exit_work() asks each task which has used the ring to remove its tctx node, by task_work, and repeats th…
CVE-2026-99245NoneKEYS: Fix key_reject_and_link() race with keyring restriction
In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix key_reject_and_link() race with keyring restriction The restrict_link check in key_reject_and_link() is done before taking the keyring semaphore, racing with…
CVE-2026-120524Medium· 6.4News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all versions up to, and including, 1.4.8 due to insufficient input sanitization and output escaping. This…
CVE-2026-121501Medium· 6.3PoCmathurvishal CloudClassroom-PHP-Project loginlinkadmin.php session_regenerate_id session fixiation
A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function session_regenerate_id of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session …
CVE-2026-120552Medium· 6.4SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()
The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sani…
CVE-2026-120574High· 8.1SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.9.5 - Unauthenticated Account Takeover
The SureCart plugin for WordPress is vulnerable to unauthenticated account takeover in all versions up to, and including, 4.9.5. The passwordless one-time-code login REST route (VerificationCodeController::verify(), whose permission call…
CVE-2026-120971Medium· 5.3Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responses
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 5…
CVE-2026-120330High· 7.1Broken Access Control in extension "Mail" (mail)
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mail…