Export limit exceeded: 414622 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414622 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59075 | 1 Edito | 1 Edito Cms | 2026-11-15 | N/A |
| Edito CMS is vulnerable to Dynamic LINQ injection. Due to improper input validation, an authenticated attacker can inject conditional expressions into the sort parameter of paginated administrative endpoints. Analyzing the returned result order allows the attacker to extract value of any field character by character, leading to potential exposure of sensitive data. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released. | ||||
| CVE-2026-59076 | 1 Edito | 1 Edito Cms | 2026-11-15 | N/A |
| Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attacker can inject malicious scripts into givenName and surname parameters via the /api/auth/profile endpoint. When an administrator visits the admin changelog logs, the injected script is automatically executed, in his browser. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released. | ||||
| CVE-2026-59077 | 1 Edito | 1 Edito Cms | 2026-11-15 | N/A |
| Edito CMS is vulnerable to Stored XSS via content parameter in Tiny editor functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when user tries to edit changed entry. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released. | ||||
| CVE-2026-59078 | 1 Edito | 1 Edito Cms | 2026-11-15 | N/A |
| Edito CMS is vulnerable to Stored XSS in avatar upload functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting an URL leading to a edited avatar. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released. | ||||
| CVE-2026-59079 | 1 Edito | 1 Edito Cms | 2026-11-15 | N/A |
| Edito CMS restricts the ability to upload files via the UI to specific file types. However, an avatar upload functionality allows an attacker to upload files of any type and extension without restriction. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released. | ||||
| CVE-2026-59080 | 1 Edito | 1 Edito Cms | 2026-11-15 | N/A |
| Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary. | ||||
| CVE-2026-59081 | 1 Edito | 1 Edito Cms | 2026-11-15 | N/A |
| Edito CMS deserializes JSON data without further validation. A user (even an administrator) cannot exploit this vulnerability through the application's normal functionality. An attacker who could modify cache entries or inject them could execute code on the server. This issue was fixed in version 5.10.2607. Hotfixes for older versions (5.8) have also been released. | ||||
| CVE-2026-127093 | 1 Rustrak | 1 Rustrak | 2026-11-15 | 5.5 Medium |
| Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can target loopback, private-network and cloud metadata addresses with custom headers and redirects followed, reading non-2xx response bodies returned in the API response. | ||||
| CVE-2026-127091 | 1 Jadaptive | 2 Maverick Legacy Server, Maverick Synergy Server | 2026-11-15 | 6.8 Medium |
| Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an improper path equivalence flaw in VirtualFileFactory.canonicalisePath that bypasses mount-level access policy. Authenticated users can supply paths with duplicate separators or dot segments to route operations to a less restrictive parent mount and read or write files the child mount denies. | ||||
| CVE-2026-127090 | 1 Jadaptive | 2 Maverick Legacy Server, Maverick Synergy Server | 2026-11-15 | 8.8 High |
| Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. Attackers holding a key authorized for one account can authenticate it, then send a signed SSH_MSG_USERAUTH_REQUEST with a different username on the same connection to log in as that account. | ||||
| CVE-2026-127081 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 4.3 Medium |
| OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment identifier to the POST /api/v1/pipeline/{pipeline_id}/stages/ endpoint, persisting cross-project associations that bypass project separation. | ||||
| CVE-2026-127080 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 9.9 Critical |
| OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise. | ||||
| CVE-2026-127079 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 7.4 High |
| OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attackers to brute force 6-digit OTPs. Attackers can initiate a reset and submit unthrottled guesses to the check_otp endpoint, resetting the target's password and taking over the account. | ||||
| CVE-2026-127078 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 7.1 High |
| OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attach another application's environment to their service by supplying a foreign project_env_id. Attackers can configure CI and trigger builds and deployments through the component env endpoints using the other application's configuration, registries and deployment infrastructure. | ||||
| CVE-2026-127077 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 7.1 High |
| OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /api/v1/project/{project_id}/env/ to target another project's cluster, then trigger builds and deployments into it, bypassing project isolation. | ||||
| CVE-2026-127076 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 6.5 Medium |
| OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and submit any git_repo_id to the ci endpoint, cloning other projects' source code, manifests, and committed secrets. | ||||
| CVE-2026-127075 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 6.5 Medium |
| OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying traversal sequences in Additional Manifest file paths. Attackers can enter paths like ../../../../etc/passwd so the renderer embeds file contents in generated manifests and logs, exposing configuration files and service-account tokens. | ||||
| CVE-2026-127074 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 4.3 Medium |
| OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log. | ||||
| CVE-2026-127073 | 1 Opstree Solutions | 1 Buildpiper | 2026-11-15 | 9.9 Critical |
| OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBinding binding a service account to cluster-admin, which the pipeline applies with cluster-wide credentials, granting control over all workloads and secrets. | ||||
| CVE-2026-115871 | 2 Renehermi, Wordpress-extensions | 2 Wp Staging – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups, Wp Staging | 2026-11-15 | 2.7 Low |
| The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint. | ||||