Tagged “cve.org”
CVEs tagged cve.org, newest first.
46469 CVEsRSS
CVE-2026-121432Low· 3.5AzuraCast before 0.24.0 CRLF Injection via Mount display_name in PLS Playlist
AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoi…
CVE-2026-121543High· 8.8smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation
smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-r…
CVE-2026-121448High· 8.3Dockhand before 1.0.54 Path Traversal via Stack Environment Routes
Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences t…
CVE-2026-65138Medium· 6.3NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.
NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys.
CVE-2026-121555High· 7.5Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb
Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative pa…
CVE-2026-121551Medium· 5.4PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-e…
CVE-2026-73328High· 7.2Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/
Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php f…
CVE-2026-65139Medium· 6.3NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.
NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution.
CVE-2026-121559High· 7.2GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning
GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admi…
CVE-2026-65140Medium· 5.7NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.
NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator.
CVE-2026-114582Medium· 5.3Server-side request forgery via SpatialReference string input
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (and related `transform()` methods and `srs`/`srid` setters) do not restrict GDAL’s file and network…
CVE-2026-65107Medium· 6.3NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.
NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to.
CVE-2026-113733Low· 2.2Password hash disclosure to "view only" admin users with custom user models
An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display_for_field()` function did not obfuscate the password field of user models other than `AUTH_USER_MODEL`, or of an `AUTH_USER…
CVE-2026-65168High· 7.0NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.
CVE-2026-65165Medium· 5.3NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.
NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.
CVE-2026-111362Medium· 5.3Server-side request forgery via crs member of GeoJSON geometries
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.OGRGeometry` does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote …
CVE-2026-108147Medium· 5.3Potential memory exhaustion in MultiPartParser via base64-encoded file upload
An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. `django.http.multipartparser.MultiPartParser` is subject to excessive memory consumption when processing multipart file uploads with base6…
CVE-2026-63417High· 8.2Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is…
CVE-2026-113593Low· 3.1Potential exposure of private data via empty and missing Vary headers
An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The `django.middleware.cache.UpdateCacheMiddleware` and the `django.views.decorators.cache.cache_page()` decorator generate identical cache key…
CVE-2026-85035High· 8.8Use-after-free via dynamically allocated message queue retained by the CAN RX filter
The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver stores that raw pointer in its filte…
CVE-2026-77778High· 7.1Improper access control vulnerability
ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
CVE-2026-65108Medium· 6.3NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.
NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions.
CVE-2026-89229Medium· 5.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files vi…
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files vi…
CVE-2026-120333High· 8.8Broken Access Control in extension "Frontend User Registration" (sf_register)
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthentica…
CVE-2026-85034Medium· 6.7Out-of-bounds write in the Bluetooth GATT client: oversized notification and indication values delivered to subscribers
The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or Multiple Handle Value Notification to bt_gatt_subscribe_params::notify callbacks using only the length derived from the…
CVE-2026-85033Medium· 4.6Bluetooth Classic AVRCP Target: missing TX cleanup on disconnect permanently stalls vendor-dependent responses and leaks them to the next peer
The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a per-connection object selected by connection index (get_avrcp_tg()), with the per-transfer context (tid, sent_len, and…
CVE-2026-119179High· 7.0MongoDB Node.js driver: Connection pool desynchronization after operation timeout can expose other user's data
A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional …
CVE-2026-85032Medium· 4.8Use-after-free in the MCTP over USB binding when the host disables the class while RX parsing is in progress
The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system workqueue runs mctp_usb_class_out_work(), which parses host OUT data byte by byte and fills a packet buffer at usb->rx_pkt, w…
CVE-2026-121505Low· 3.7Out-of-bounds Read in NTPsec
An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4 allows a malicious NTS-KE server to read the client's stack memory, including pointers that defeat ASLR, which the clien…
CVE-2026-57154High· 8.1PoCOPNsense: Configuration line injection via multiple GUI text fields
OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line,…