Tagged “cve.org”
CVEs tagged cve.org, newest first.
46469 CVEsRSS
CVE-2026-121508Medium· 5.9Use After Free in µD3TN
Use-After-Free in µD3TN BPv6 Fragmenter Cleanup allows Unauthenticated Remote Attacker to Cause DoS on Allocation Failure
CVE-2026-121513High· 7.5Out-of-bounds Write in µD3TN
Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoS
CVE-2026-121562Medium· 5.3CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint
CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that exposes non-public team custom field values. Unauthenticated attackers can paginate GET requests to collect hidden registrat…
CVE-2026-121561High· 7.7PoCLabel Studio before 1.23.2 SSRF and Token Disclosure via Image Export Downloads
Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with d…
CVE-2026-121558Medium· 4.3AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id
AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in rag/agentic_rag.py that allows authenticated users to read other projects' knowledge by supplying project_id. Attackers with read:kno…
CVE-2026-121557Medium· 5.9WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or…
CVE-2026-121553Medium· 4.8PoCCotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())
Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP…
CVE-2026-121545Medium· 6.5PoCDreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler
Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Atta…
CVE-2026-121455Medium· 5.4DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbi…
CVE-2026-121546Medium· 5.9ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a data…
CVE-2026-121450High· 7.5PoCCFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID
CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers ca…
CVE-2026-121550Low· 3.3nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented pred…
CVE-2026-121549Medium· 4.4PoCnnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-deri…
CVE-2026-121454Low· 3.7PoCPadloc through 4.3.0 Missing SCIM Token Validation via SCIM GET Requests
Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization …
CVE-2026-121451High· 8.8AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF
AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can…
CVE-2026-121447Medium· 6.1svg-sanitizer before 1.1.0 XSS via animateTransform on Safari
svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose anim…
CVE-2026-121446Medium· 4.3PoCsvg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes
svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG f…
CVE-2026-121442Medium· 4.3Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advanc…
CVE-2026-121443Medium· 5.3svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<'…
CVE-2026-121438Medium· 5.3PoCMistune before 3.3.3 Denial of Service via Balanced Bracket Link Parsing
Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to cause quadratic CPU growth by supplying balanced nested brackets. Attackers can submit crafted Markdown with thousands of…
CVE-2026-121435Medium· 4.3Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API
Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create MySQL databases by calling the Mysqls.add API endpoint, which lacks the customer_hide_options check. Customers can invoke …
CVE-2026-121434Medium· 5.4PoCFroxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API
Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can o…
CVE-2026-121430Medium· 5.4PoCAzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints
AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can rea…
CVE-2026-121431Medium· 5.3AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connectors
AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can…
CVE-2026-121423Medium· 6.5SurrealDB before 3.3.0 DoS via Unbounded Recursion in val::Value Serialization
SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapp…
CVE-2026-121427High· 7.5AzuraCast through 0.23.8 Config Injection via frontend_config.custom_config
AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Sh…
CVE-2026-121426Medium· 6.5PoCNodemailer 3.0.0 before 10.1.4 Recipient Domain Confusion via addressparser
Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an all…
CVE-2026-121419High· 8.1SurrealDB 3.1.0 before 3.3.0 MCP Session Hijack via BoundSubject Collision
SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privile…
CVE-2026-121422Medium· 4.1PoCSurrealDB from 3.1.0 before 3.3.0 SSRF via JWKS Implicit Default Port Bypass
SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or re…
CVE-2026-121418Medium· 4.3PoCSurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner
SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attac…