Export limit exceeded: 425667 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425667 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425667 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425667 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425667 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425667 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126494 | 1 Open-emr | 1 Openemr | 2026-11-13 | 7.1 High |
| OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows read-only SMART/OAuth clients to obtain write scopes because ScopeEntity::containsScope() ignores registered permissions. Attackers with a client registered for user/<resource>.read can request user/<resource>.write to create, update, and delete appointments or patient data. | ||||
| CVE-2026-126936 | 2026-11-13 | 5.9 Medium | ||
| Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, upload storage quotas, and shortened-URL quotas through concurrent requests. Attackers can send overlapping registration, upload, or URL creation requests that pass checks against stale state, creating extra accounts and exceeding administrator-configured resource quotas. | ||||
| CVE-2026-126937 | 2026-11-13 | 8.1 High | ||
| Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance. | ||||
| CVE-2026-126938 | 2026-11-13 | 7.1 High | ||
| Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space. | ||||
| CVE-2026-126939 | 2026-11-13 | 5.3 Medium | ||
| Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts. | ||||
| CVE-2026-126940 | 2026-11-13 | 6.5 Medium | ||
| Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints to perform credential guessing beyond the intended rate limits. | ||||
| CVE-2026-126941 | 2026-11-13 | 6.8 Medium | ||
| Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders. | ||||
| CVE-2026-126942 | 2026-11-13 | 5.4 Medium | ||
| Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims' file URLs and removing those files from their folder views. | ||||
| CVE-2026-126943 | 2026-11-13 | 4.9 Medium | ||
| Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens. | ||||
| CVE-2026-126944 | 2026-11-13 | 5.7 Medium | ||
| Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process. | ||||
| CVE-2026-126945 | 2026-11-13 | 8.7 High | ||
| Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf. | ||||
| CVE-2026-126946 | 2026-11-13 | 5.4 Medium | ||
| Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages. | ||||
| CVE-2026-126947 | 2026-11-13 | 5.4 Medium | ||
| Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages. | ||||
| CVE-2026-126948 | 2026-11-13 | 8.8 High | ||
| Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it. | ||||
| CVE-2026-126949 | 2026-11-13 | N/A | ||
| Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents. | ||||
| CVE-2026-126950 | 2026-11-13 | N/A | ||
| Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary server files by injecting traversal sequences via the x-zipline-file-extension header. Attackers can upload a file with a poisoned stored name and short expiry so LocalDatasource deletion removes chosen files, causing denial of service or data loss. | ||||
| CVE-2026-126951 | 2026-11-13 | N/A | ||
| Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow. | ||||
| CVE-2026-126952 | 2026-11-13 | 8.1 High | ||
| Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can impersonate that account without its authenticator, potentially gaining administrative control over SUPERADMIN accounts. | ||||
| CVE-2026-126953 | 2026-11-13 | 8.1 High | ||
| Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues request with shell metacharacters that set_UserUsername() in obuspa_system.lua passes to os.execute(), gaining root command execution. | ||||
| CVE-2026-126954 | 1 Glance Project | 1 Glance | 2026-11-13 | 4.7 Medium |
| Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title, reading dashboard pages through same-origin requests and exfiltrating content. | ||||