Export limit exceeded: 408314 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408314 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408314 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109332 | 1 Network-ai | 1 Network-ai | 2026-10-15 | 3.1 Low |
| Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with a localhost Origin visited by a victim can read unauthenticated endpoints like /health cross-origin. | ||||
| CVE-2026-109327 | 1 Admidio | 1 Admidio | 2026-10-15 | 6.1 Medium |
| Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript: URL containing a decoy http:// segment that passes validation and executes script in the Admidio origin when victims click the redirect link. | ||||
| CVE-2026-109322 | 1 Getgrav | 1 Grav-plugin-guestbook | 2026-10-15 | 6.1 Medium |
| Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions. | ||||
| CVE-2026-109317 | 1 Getgrav | 1 Grav-plugin-api | 2026-10-15 | 7.2 High |
| Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints. | ||||
| CVE-2026-109312 | 1 Getgrav | 1 Grav-plugin-login | 2026-10-15 | 8.1 High |
| Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account. | ||||
| CVE-2026-109307 | 1 Craftcms | 1 Craft Cms | 2026-10-15 | 4.7 Medium |
| Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submission and TOTP verification, executing JavaScript in the authenticated control panel with the victim's permissions. | ||||
| CVE-2026-109302 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-10-15 | 3.7 Low |
| Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names. | ||||
| CVE-2026-109297 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-15 | 6.5 Medium |
| Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll. | ||||
| CVE-2026-109292 | 1 Openwebui | 1 Open Webui | 2026-10-15 | 6.8 Medium |
| Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators. | ||||
| CVE-2026-109287 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-15 | 4.3 Medium |
| Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors. | ||||
| CVE-2026-109282 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 2.5 Low |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service. | ||||
| CVE-2026-109277 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 3.3 Low |
| ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies. | ||||
| CVE-2026-109272 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 3.7 Low |
| ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service. | ||||
| CVE-2026-109267 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 5.3 Medium |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service. | ||||
| CVE-2026-109262 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 5.3 Medium |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption. | ||||
| CVE-2026-109257 | 1 Freerdp | 1 Freerdp | 2026-10-15 | 5.9 Medium |
| FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown. | ||||
| CVE-2026-109252 | 1 Freerdp | 1 Freerdp | 2026-10-15 | 5.3 Medium |
| FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERB_RPC_INTERNAL_NAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names pointer, causing cleanup to dereference a null base and terminate the client. | ||||
| CVE-2026-109247 | 1 Freerdp | 1 Freerdp | 2026-10-15 | 3.1 Low |
| FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenates server-supplied cFileName values from FileGroupDescriptorW clipboard data into the published local file:// URI without rejecting '/' or '..' sequences. A malicious RDP server can supply '../' sequences so the user's next clipboard paste copies an arbitrary local file readable by the client user instead of the expected remote file. | ||||
| CVE-2026-109242 | 1 Freerdp | 1 Freerdp | 2026-10-15 | 7.1 High |
| FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing. A malicious RDP server can send a crafted WBT_TILE_FIRST then WBT_TILE_UPGRADE sequence to paint heap bytes onscreen or abort the client process. | ||||
| CVE-2026-109237 | 1 Unclecode | 1 Crawl4ai | 2026-10-15 | 8.1 High |
| Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in dict-type wrappers. Attackers can send a laundered LLMConfig with api_token set to an env reference via /config/dump to read SECRET_KEY and provider keys, enabling admin JWT forgery. | ||||