Tagged “nvd”
CVEs tagged nvd, newest first.
51020 CVEsRSS
CVE-2026-109359High· 7.7Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation
Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can repla…
CVE-2026-109358High· 7.8Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666)
Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable (0666). Local unprivileged users on the node can modify the containerd con…
CVE-2026-109357High· 8.1PoCLibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence
LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTE_USER i…
CVE-2026-109356Medium· 4.3LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges
LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE request…
CVE-2026-109355Medium· 6.1LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in get_oxidized_nodes_list() that renders Oxidized API fields and SNMP sysName unescaped. Attackers controlling the Oxidized response or a device's SNMP sysName …
CVE-2026-109354Medium· 4.3LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter
LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsen_channel_common.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to …
CVE-2026-109353High· 7.1PoCLibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php
LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users…
CVE-2026-109352Medium· 6.1PoCLibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into…
LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into…
CVE-2026-109351Medium· 6.5PoCGitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count
Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process by supplying a huge pack-header object count. Malicious remotes can serve a 12-byte pack header cl…
CVE-2026-109350Medium· 6.5PoCGitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries
Gitoxide gix-pack before 0.75.0 contains a denial of service vulnerability that allows malicious remotes to crash fetch operations by sending crafted thin-pack OFS_DELTA entries. Attackers can serve a thin pack with a REF_DELTA referenci…
CVE-2026-109349Medium· 6.5gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2
gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte …
CVE-2026-109348Medium· 4.3PoCGitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes
Gitoxide gix-mailmap before 0.35.0 contains a denial of service vulnerability that allows attackers to exhaust CPU through quadratic-time parsing in Snapshot::from_bytes. Attackers can commit a crafted .mailmap with descending-ordered en…
CVE-2026-109347High· 7.2PoCAdminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark
Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a databas…
CVE-2026-109346High· 8.1better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope
better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /devic…
CVE-2026-109345Medium· 6.1PoCDOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup
DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because IN_PLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply …
CVE-2026-109344Medium· 6.1DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks
DOMPurify from 3.4.13 before 3.4.16 contains a cross-site scripting vulnerability because IN_PLACE mode fails to neutralize subtrees detached by afterSanitizeElements or afterSanitizeAttributes hooks. Attackers can supply markup with on*…
CVE-2026-109343High· 8.1SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it
SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or re…
CVE-2026-109342Medium· 5.4SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession
SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attac…
CVE-2026-109341High· 7.1SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use…
CVE-2026-109340Medium· 5.4SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE
SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a reference…
CVE-2026-109339Medium· 4.9SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit
SurrealDB 3.1.0 before 3.3.0 lets Surrealism modules exhaust server memory because module stdout/stderr lines are buffered unbounded in host memory, bypassing the configured module memory limit. An attacker can run an Owner-installed mal…
CVE-2026-109338Medium· 6.5SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript
SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via He…
CVE-2026-109337Medium· 4.3SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft …
CVE-2026-109336Medium· 4.3SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections
SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unre…
CVE-2026-109335Medium· 6.5SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields
SurrealDB from 3.0.0 before 3.3.0 contains an information disclosure vulnerability that allows record users to read values hidden by field-level SELECT permissions through COMPUTED fields. Attackers can select records whose readable COMP…
CVE-2026-109334High· 8.1SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access
SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surr…
CVE-2026-109333Medium· 6.5SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH
SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a for…
CVE-2026-109332Low· 3.1PoCNetwork-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface
Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When …
CVE-2026-109331High· 7.4Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field
Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place …
CVE-2026-109330Medium· 4.3PoCNetwork-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation
Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers ca…