Export limit exceeded: 403385 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (403385 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111635 | 1 Helicalinsight | 1 Helicalinsight | 2026-10-26 | 4.3 Medium |
| Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of /getExternalResource. Attackers can supply parent-directory segments to read any readable file with an allowed extension such as js, json, or html, bypassing per-resource access control. | ||||
| CVE-2026-111636 | 1 Openbmb | 1 Staffdeck | 2026-10-26 | 8.1 High |
| OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials. | ||||
| CVE-2026-111637 | 1 Blair2004 | 1 Nexopos | 2026-10-26 | 5.3 Medium |
| NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field classes like ns.entity-transaction with sequential ids to retrieve names, values, account ids, and descriptions without nexopos.read.transactions permission. | ||||
| CVE-2026-111638 | 1 Moul | 1 Sshportal | 2026-10-26 | 7.7 High |
| sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can request predictable key names like 'default' or 'host' to retrieve private keys and connect directly to backend hosts, bypassing ACLs and session recording. | ||||
| CVE-2026-111643 | 1 L429609201 | 1 Misaka Danmu Server | 2026-10-26 | 9.8 Critical |
| Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator. | ||||
| CVE-2026-111644 | 1 L429609201 | 1 Misaka Danmu Server | 2026-10-26 | 7.3 High |
| Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-index and health routes under /api/ui lacking the get_current_user dependency. Attackers can read audit logs with login IPs, server logs and environment paths, delete episode rows, clear media-server mappings, and wipe audit history. | ||||
| CVE-2026-111648 | 1 Build-admin | 1 Buildadmin | 2026-10-26 | 2.7 Low |
| BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend administrators to modify other administrators' profiles via the id parameter. Attackers holding the routine/adminInfo/edit permission can overwrite avatar, nickname, email, mobile and motto fields, including a super administrator's email and mobile. | ||||
| CVE-2026-111649 | 1 Rocboss | 1 Paopao-ce | 2026-10-26 | 6.5 Medium |
| Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access private media by supplying arbitrary content IDs. Attackers can enumerate sequential post_content ids via the /v1/attachment endpoint to obtain signed download URLs for other users' private, friend-only and following-only images, videos and attachments. | ||||
| CVE-2026-111650 | 1 Hoshinosuzumi | 1 Chronoframe | 2026-10-26 | 8.6 High |
| ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated attackers to reconfigure already configured instances. Attackers can POST to /api/wizard/storage to activate an attacker-controlled S3 or OpenList provider, redirecting uploads and storage reads, and overwrite site and map settings. | ||||
| CVE-2026-111653 | 1 53ai | 1 53aihub | 2026-10-26 | 5.3 Medium |
| 53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to overwrite any enterprise's profile by sending PUT requests to /api/enterprises/:id. Because UpdateEnterprise only enforces checks when IS_SAAS is true, attackers can enumerate sequential enterprise IDs and overwrite logos, display names and branding for defacement and phishing. | ||||
| CVE-2026-111655 | 1 Zoujingli | 1 Think-plugs-admin | 2026-10-26 | 3.8 Low |
| ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership. | ||||
| CVE-2026-111656 | 1 Zhimaai | 1 Chatwiki | 2026-10-26 | 5.4 Medium |
| ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order. | ||||
| CVE-2026-111659 | 1 Wayn111 | 1 Waynboot-mall | 2026-10-26 | 6.5 Medium |
| Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock. | ||||
| CVE-2026-111671 | 1 Data-infra | 1 Cube-studio | 2026-10-26 | 7.1 High |
| Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline. | ||||
| CVE-2026-111672 | 1 Data-infra | 1 Cube-studio | 2026-10-26 | 4.3 Medium |
| Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines. | ||||
| CVE-2026-111675 | 1 Xiaochong0302 | 1 Course-tencent-cloud | 2026-10-26 | 7.4 High |
| Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts. | ||||
| CVE-2026-111683 | 1 Allegro | 1 Ralph | 2026-10-26 | 5.4 Medium |
| Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset. Attackers can call DCAssetsView and SRRacksAPIView at /api/rack/<id> and /api/server_room/<id> to read asset hostnames, serials and management IPs, and to modify, move or create racks. | ||||
| CVE-2026-111693 | 1 Databufflabs | 1 Databuff | 2026-10-26 | 9.8 Critical |
| DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes. | ||||
| CVE-2026-111694 | 1 Qiantongtech | 1 Qknow | 2026-10-26 | 5.3 Medium |
| qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints permitted in SecurityConfig. Attackers can POST sequential userId values to /flyflow/userById or call roleAll and deptListByParentDeptId to enumerate user phone numbers, roles, and department structure. | ||||
| CVE-2026-111695 | 1 Shaiwz | 1 Data-platform-open | 2026-10-26 | 7.1 High |
| Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources. | ||||