Tagged “nvd”
CVEs tagged nvd, newest first.
51023 CVEsRSS
CVE-2026-69227Critical· 9.8A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions
A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.
CVE-2026-69226Medium· 6.5A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true)
A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by…
CVE-2026-66057Medium· 5.1Frappe is a full-stack web application framework
Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redir…
CVE-2026-61642High· 7.7Squid is a caching proxy for the Web
Squid is a caching proxy for the Web. From 3.3.0.1 to before 7.6, due to an improper enforcement of behavioral workflow bug, Squid is vulnerable to a Request Smuggling attack against HTTP/1.1 Transfer-Encoding. HTTP header parsing (`src/…
CVE-2026-55823High· 8.7Frappe is a full-stack web application framework
Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL ex…
CVE-2026-55562Critical· 9.0PoCCronicle is a multi-server task scheduler and runner, with a web based front-end UI
Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value int…
CVE-2026-55183Critical· 9.6PoCRClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently
RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin *, an…
CVE-2026-54454Critical· 9.1OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams
OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for…
CVE-2026-53562High· 8.5Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.
Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2.
CVE-2026-19940Medium· 6.5The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index
The Bluetooth Classic Hands-Free Profile Audio Gateway implementation in subsys/bluetooth/host/classic/hfp_ag.c keeps its struct bt_hfp_ag objects in a static pool indexed by ACL connection index. On link teardown, hfp_ag_disconnected() …
CVE-2026-19939Medium· 6.3The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request
The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request. Every response handler in subsys/bluetooth/host/classic/avdtp.c cancels session->timeout_wo…
CVE-2026-110131Medium· 5.3ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles
ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can re…
CVE-2026-110129Medium· 6.5PoCfuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records
fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can regist…
CVE-2026-110128High· 7.5fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint
fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's order details via the /clientApi/order/detail endpoint. Attackers can enumerate sequential orderI…
CVE-2026-110127Medium· 4.3PoCwaynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart …
CVE-2026-110126Medium· 5.4waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController that allows authenticated members to modify or delete other members' shipping addresses. Attackers can enumerate auto-increment a…
CVE-2026-110125Medium· 6.3Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential …
CVE-2026-110124High· 8.1PoCFastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registe…
CVE-2026-110123High· 7.1Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required autho…
Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required autho…
CVE-2026-110122Medium· 4.3PoCPickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and…
CVE-2026-110121Medium· 6.5PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to overwrite any store's product by supplying another store's goodsId to the goods update endpoint. Attackers can …
CVE-2026-110120Medium· 5.4Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call…
CVE-2026-110119High· 7.1PoCYshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses
Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate seque…
CVE-2026-110118Medium· 6.5WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints
WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a k…
CVE-2026-110117Medium· 6.5PoCSmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings
SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated u…
CVE-2026-110116Critical· 9.1Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files
Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and…
CVE-2026-110115High· 7.5Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent…
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent…
CVE-2026-110114Medium· 6.5PoCFJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods
FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can r…
CVE-2026-110113Medium· 4.3PoCPublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses
PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save handler that allows authenticated members to modify other members' shipping addresses. Attackers can…
CVE-2026-110110Medium· 4.3PoCJetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration
JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack…