Export limit exceeded: 425667 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425667 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425667 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425667 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425667 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-70642 | 1 Tooljet | 1 Tooljet | 2026-11-13 | 4.3 Medium |
| ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments init endpoint that allows authenticated users to read app version metadata belonging to other workspaces. Attackers can send GET requests to /api/app-environments/init with an editing_version_id from another workspace to retrieve the version name, description, status, current environment ID, and app ID, because the lookup is not scoped to the caller's organization. | ||||
| CVE-2026-127030 | 3 Freeradius, Red Hat, Redhat | 4 Freeradius, Enterprise Linux, Enterprise Linux and 1 more | 2026-11-13 | 7.5 High |
| A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS). | ||||
| CVE-2026-68548 | 1 Xyproto | 1 Algernon | 2026-11-13 | 9.4 Critical |
| Algernon is a small self-contained pure-Go web server. Prior to version 1.17.10, Algernon's URL-prefix authorization gate matches its protected prefixes (/admin, /repo, /data) with case-sensitive strings.HasPrefix, while the exact same raw req.URL.Path is later resolved against the filesystem. On case-insensitive filesystems (Windows NTFS — always; macOS APFS/HFS+ — default), a request for /Admin/secret.lua evades every protected-prefix check, falls through to the public-prefix accept branch, and then resolves on disk to admin/secret.lua. The result is an unauthenticated bypass of the /admin, /repo, and /data authorization boundary, enabling read (and, for Lua files, execution) of protected content. The permission system is active in the default configuration. This issue has been patched in version 1.17.10. | ||||
| CVE-2026-62971 | 1 Coreruleset | 1 Coreruleset | 2026-11-13 | 7.2 High |
| The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, CRS rules in the 921 (protocol-attack), 930 (LFI), 931 (RFI), 932 (RCE), 933 (PHP), 934 (generic), 941 (XSS), 942 (SQLi), and 943 (session-fixation) families inspect XML request bodies via the XPath expression XML:/*. That expression matches only element text nodes — it does not match XML attribute values. As a result, an attacker who places an attack payload inside an XML attribute (e.g. <a href="javascript:alert(1)=window.name"></a> or <a value="' OR 1=1 --"></a>) bypasses CRS detection entirely. This is verified empirically against a local CRS test instance and against the public CRS sandbox. The bypass affects approximately 159 rules across 9 rule files and applies at every paranoia level (PL1 through PL4), since the variable list is more or less shared across PLs. The 944 (Java) family is the only one that correctly includes XML://@* in addition to XML:/* and is therefore unaffected. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0. | ||||
| CVE-2026-61619 | 1 Coreruleset | 1 Coreruleset | 2026-11-13 | N/A |
| The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls. Prior to versions 3.3.10, 4.25.1, and 4.28.0, regular-expression denial of service (ReDoS) affects a shared regex-assembly include used to build 12 Unix RCE detection rules in CRS v4, and the same ambiguous pattern was present in the manually-assembled regexes in 4 rules in CRS v3.3. With a single, unauthenticated, crafted request, the generated pattern drives PCRE2 past its backtracking limit. When PCRE2 exceeds that limit, the @rx operator returns an error rather than a match result, which results in detection bypass and CPU denial of service. This issue has been patched in versions 3.3.10, 4.25.1, and 4.28.0. | ||||
| CVE-2026-64861 | 1 Getprobo | 1 Probo | 2026-11-13 | 4.3 Medium |
| Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.222.0, the GraphQL endpoint does not enforce restrictions on alias count, query depth, or query complexity. An attacker can send a single request containing thousands of aliased resolver calls, causing excessive server-side resource consumption and service degradation. This issue has been patched in version 0.222.0. | ||||
| CVE-2026-63505 | 1 Getprobo | 1 Probo | 2026-11-13 | 4.9 Medium |
| Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.223.1, Probo's console GraphQL API is a multi-tenant GRC platform where all data is scoped to an organization. A Finding can reference a Risk via finding.riskId. That reference is stored without validating that the risk belongs to the caller's organization, and the Finding.risk field resolver authorizes the finding (caller's org) instead of the risk, then loads the risk with a tenant scope derived from the risk's own global ID. As a result, an authenticated member of organization A can attach an arbitrary organization B risk GID to a finding they own and then read organization B's Risk (name, description, treatment, category, severity, owner) — with no membership in B. The stored cross-tenant reference also blocks B from deleting its own risk (ON DELETE RESTRICT), a cross-tenant integrity/DoS. This issue has been patched in version 0.223.1. | ||||
| CVE-2026-65840 | 1 Getfider | 1 Fider | 2026-11-13 | 9.6 Critical |
| Fider is a feedback portal for feature requests and suggestions. Prior to version 0.36.0, in multi-tenant mode (HOST_MODE=multi), an attacker can use an email verification key issued by Tenant A to authenticate as the same email address on Tenant B. This completely bypasses tenant isolation and allows unauthorized account takeover across tenants. Single-host deployments (HOST_MODE=single, the default) are NOT affected. This issue has been patched in version 0.36.0. | ||||
| CVE-2026-65967 | 1 Getfider | 1 Fider | 2026-11-13 | 7.1 High |
| Fider is a feedback portal for feature requests and suggestions. Prior to version 0.34.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Fider due to insufficient validation of webhook URLs. The application allows user-controlled URLs to be fetched by the server without restricting access to internal or external network resources. This enables attackers with administrative privileges to make arbitrary HTTP requests from the server, potentially accessing internal services or cloud metadata endpoints. This issue has been patched in version 0.34.0. | ||||
| CVE-2026-65965 | 1 3xpyth0n | 1 Ideon | 2026-11-13 | N/A |
| ideon is a self-hosted visual workspace. Prior to version 0.9.4, several project mutation endpoints under /api/projects/[id]/* resolve the caller's project role but never enforce it, so a user who was granted only the read-only viewer role on a project can perform write operations on that project. The most severe is POST /api/projects/[id]/graph, which deletes every block and link in the project and re-inserts client-supplied ones. A viewer can silently rewrite or wipe the entire canvas of a project they were invited to read. The application clearly intends viewer to be read-only: the collaborators endpoint, the automation endpoints, and the realtime Yjs sync path all reject write attempts from viewers. These specific HTTP handlers simply omit the guard their siblings enforce. This issue has been patched in version 0.9.4. | ||||
| CVE-2026-65968 | 1 3xpyth0n | 1 Ideon | 2026-11-13 | N/A |
| ideon is a self-hosted visual workspace. Prior to version 0.9.4, validateUrlForSSRF() / safeFetch() in lib/oauth/ssrf-protection.ts (and the parallel validateMcpUrl() in lib/security/validators.ts) perform SSRF host-blocking by string/regex matching on new URL(url).hostname. Their IPv6 branch only recognises the textual forms ::1, fe80:/fc00:/fd00: prefixes, and the dotted-decimal IPv4-mapped form ::ffff:127.x. It does not recognise the WHATWG-canonical IPv4-mapped-IPv6 host that Node emits for a mapped address, which is hex-compressed and bracket-wrapped: [::ffff:7f00:1] for 127.0.0.1, [::ffff:a9fe:a9fe] for 169.254.169.254. An authenticated user who registers a STREAMABLE_HTTP / SSE MCP server with URL http://[::ffff:7f00:1]:PORT/ (loopback) or http://[::ffff:a9fe:a9fe]/ (cloud metadata) passes both guards, and the server-side OAuth-discovery action then fetches that host, yielding server-side request forgery to loopback and to the cloud metadata service. This issue has been patched in version 0.9.4. | ||||
| CVE-2026-16550 | 1 Synology | 1 Diskstation Manager | 2026-11-13 | 6.5 Medium |
| An external control of file name or path vulnerability in the Media Parser in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write arbitrary files. | ||||
| CVE-2026-11732 | 1 Netgear | 4 Cax30, Rax30, Rax5 and 1 more | 2026-11-13 | 8.8 High |
| An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker with access to the local network (such as through Wi-Fi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on. | ||||
| CVE-2026-120033 | 1 Frrouting | 1 Frrouting | 2026-11-13 | N/A |
| In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to be up. A BGP neighbor that keeps sending KEEPALIVEs but stops reading from its connection, at a time when the router has a large amount of data to send to it (for example while sending it a full routing table), can trigger this. If the neighbor announced Graceful Restart support, bgpd crashes shortly after the session is closed, taking down all BGP sessions on the router, and the neighbor can repeat this each time bgpd restarts. Otherwise, the session stays stuck in the Established state: the neighbor's routes stay installed and keep being advertised to other peers, and the neighbor cannot reconnect until an operator clears the session manually. The neighbor does not need to be malicious; an overloaded or stuck peer can trigger the same behavior. No special configuration is required: any established BGP neighbor can trigger the issue, and Graceful Restart helper mode, which leads to the crash, is enabled by default. | ||||
| CVE-2026-117373 | 2026-11-13 | N/A | ||
| Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied media path when an ondemand stream is created. The path is validated only by checking whether it contains one of the audio extensions and is then passed to the file source which opens it. No canonicalization is performed and no directory allowlist is enforced, so an unauthenticated caller can make the server open an arbitrary local file and use it as a media source, with the content delivered to viewers as RTP audio. | ||||
| CVE-2026-116633 | 1 Lenovo | 13 Idea Tab Pro Tb373fu, Idea Tab Tab K11 Gen 2 Tb336zu, Lenovo Idea Tab Lenovo Tab K11 Gen 2 Tb336fu and 10 more | 2026-11-13 | 7.1 High |
| A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an arbitrary file write with elevated privileges. | ||||
| CVE-2026-117687 | 3 Six Apart, Six Apart Ltd, Sixapart | 6 Movable Type, Movable Type Advanced, Movable Type Premium and 3 more | 2026-11-13 | N/A |
| Movable Type provided by Six Apart Ltd. contains a code injection vulnerability in its Dynamic Publishing functionality. By sending a specially crafted request that is processed by the Dynamic Publishing, an attacker may be able to execute arbitrary PHP code on the affected product. | ||||
| CVE-2026-116835 | 1 Octopus | 1 Octopus Server | 2026-11-13 | N/A |
| In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit accounts to cause Octopus Server to issue signed OIDC tokens that impersonate a different project. This could grant access to external systems, such as cloud providers or other Octopus instances, that trust that project's identity. | ||||
| CVE-2026-49236 | 1 Apache | 1 Xml Graphics Batik | 2026-11-13 | N/A |
| Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics Batik. SVG color-profile xml:base bypasses Batik external resource same-origin checks This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue. | ||||
| CVE-2026-6467 | 1 Postgresql | 1 Postgresql | 2026-11-13 | 7.2 High |
| Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||