Export limit exceeded: 373245 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 373245 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373245 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-74903 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-21 | 4.3 Medium |
| SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instead of CheckAdminRole like its sibling endpoint. Authenticated users with RoleEditor or RoleReader roles can invoke the endpoint to transform arbitrary DOM input, and large payloads cause endpoint starvation through per-path mutex serialization. | ||||
| CVE-2026-74904 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-21 | 7.5 High |
| SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access filtering, allowing anonymous publish-mode readers to disclose private block content-derived text, structural metadata, and existence information for arbitrary block IDs across the workspace. | ||||
| CVE-2026-74905 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-21 | 7.1 High |
| SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does not recognize IPv6 transition addresses (NAT64 64:ff9b::/96, 6to4 2002::/16, Teredo 2001::/32) that embed private IPv4 destinations. When SafeMode is enabled, an authenticated attacker can bypass the SSRF guard via the network forward proxy, WebSocket proxy, or SSE proxy endpoints by supplying a URL whose hostname resolves to such a transition address, reaching internal services and cloud metadata endpoints (e.g., 169.254.169.254). Because the forward proxy returns the full response body, this is a full-read SSRF that can be used to steal instance credentials, reach internal services, and port-scan internal infrastructure. | ||||
| CVE-2026-53497 | 2026-08-21 | 5.3 Medium | ||
| CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. Any unauthenticated network attacker can enumerate this data without credentials. Version 0.9.21 fixes the issue. | ||||
| CVE-2026-74906 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-21 | 7.5 High |
| SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints. | ||||
| CVE-2026-24301 | 1 Microsoft | 2 Copilot, Copilot Web | 2026-08-21 | 8.8 High |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-73396 | 2 Makewebbetter, Wordpress | 2 Hubspot For Woocommerce, Wordpress | 2026-08-21 | 7.1 High |
| Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions. | ||||
| CVE-2026-73404 | 2 Stylemixthemes, Wordpress | 2 Masterstudy Lms, Wordpress | 2026-08-21 | 6.5 Medium |
| Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions. | ||||
| CVE-2026-73996 | 2 Masteriyo, Wordpress | 2 Masteriyo, Wordpress | 2026-08-21 | 9.8 Critical |
| Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions. | ||||
| CVE-2026-74004 | 2 Wordpress, Wpmonks | 2 Wordpress, Gravity Booster – Styles & Layouts For Gravity Forms | 2026-08-21 | 5.4 Medium |
| Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions. | ||||
| CVE-2026-74006 | 2 Wordpress, Wptablebuilder | 2 Wordpress, Wp Table Builder | 2026-08-21 | 4.3 Medium |
| Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions. | ||||
| CVE-2026-74007 | 2 Iberezansky, Wordpress | 2 3d Flipbook – Pdf Embedder, Pdf Flipbook Viewer, Flipbook Image Gallery, Wordpress | 2026-08-21 | 5.3 Medium |
| Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions. | ||||
| CVE-2026-71539 | 1 N8n | 1 N8n | 2026-08-21 | N/A |
| n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1. | ||||
| CVE-2026-48798 | 1 Sshnet | 1 Ssh.net | 2026-08-21 | 7.1 High |
| SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowing a malicious, compromised, or man-in-the-middle server to use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. This issue is fixed in version 2026.0.0. | ||||
| CVE-2026-66793 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-21 | 8.8 High |
| A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes. A user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation. | ||||
| CVE-2026-59825 | 1 Joinmastodon | 1 Mastodon | 2026-08-21 | 7.4 High |
| Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate verification globally for requests made by puma web processes while sidekiq background jobs remain unaffected. This issue is fixed in versions 4.4.19 and 4.5.12. | ||||
| CVE-2026-50187 | 1 Ohmyz | 1 Ohmyzsh | 2026-08-21 | 8.8 High |
| Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file to execute with the current account's privileges, including without a prompt when ZSH_DOTENV_PROMPT=false or after the default prompt accepts an empty Enter response. This issue is fixed in versions released after 2026-05-28. | ||||
| CVE-2026-75485 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-21 | 5.5 Medium |
| A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive. | ||||
| CVE-2026-71574 | 1 Joomla | 1 Joomla! | 2026-08-21 | N/A |
| Joomla! Core - [20260803] - Inconsistent ACL checks for mutating webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI. | ||||
| CVE-2026-73373 | 1 Joomla | 2 Joomla!, Joomla! Framework Filter Package | 2026-08-21 | N/A |
| Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution. | ||||