Export limit exceeded: 92284 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 44695 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (44695 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-104070 | 1 Spip | 1 Spip Crayons Plugin | 2026-10-09 | 9.8 Critical |
| The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, causing the authorization dispatcher to resolve an unconditionally-true handler instead of the proper modification check. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user. | ||||
| CVE-2026-88252 | 2 Redhat, Sssd | 4 Enterprise Linux, Openshift, Openshift Container Platform and 1 more | 2026-10-09 | 4.7 Medium |
| A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed. | ||||
| CVE-2026-104944 | 1 Tp-link | 1 Tapo C500 V2 | 2026-10-09 | N/A |
| TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in a denial-of-service condition. Successful exploitation may allow an unauthenticated attacker with network access to the affected UDP service to repeatedly crash the TDP daemon, disrupting normal device operation and availability. No authentication, session establishment, or pairing is required to trigger the condition. | ||||
| CVE-2026-106511 | 1 Multiversx Labs | 1 Multisig-improved | 2026-10-09 | 9.8 Critical |
| MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures. | ||||
| CVE-2026-43598 | 1 Amd | 8 Instinct Mi210, Instinct Mi250, Instinct Mi300a and 5 more | 2026-10-09 | N/A |
| Improper input validation in the AMD ROCm Communication Collectives Library (RCCL) could allow a compromised peer rank or network-adjacent attacker to dereference an attacker-controlled pointer, potentially resulting in remote code execution. | ||||
| CVE-2026-106456 | 1 Backstage | 2 Backstage, Plugin-proxy-backend | 2026-10-09 | 4.8 Medium |
| Backstage is an open framework for building developer portals. From 0.5.0 until 0.6.18, the @backstage/plugin-proxy-backend package is affected by inconsistent credential enforcement for overlapping proxy routes. An operator can configure overlapping proxy paths with different credential requirements. When a parent path permits unauthenticated access and a nested path requires credentials, the parent exemption can also cover requests handled by the nested proxy. An unauthenticated caller may therefore reach the nested upstream through Backstage, including with static upstream credentials configured for that proxy. This issue is fixed in version 0.6.18. | ||||
| CVE-2026-106458 | 1 Backstage | 2 Backstage, Plugin-catalog-backend-module-bitbucket-server | 2026-10-09 | 6.5 Medium |
| Backstage is an open framework for building developer portals. From 0.4.0 until 0.5.15, the @backstage/plugin-catalog-backend-module-bitbucket-server package is affected by inconsistent repository filtering in bitbucket server catalog event updates. Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a filtered-out repository that remains readable by the configured Backstage integration can trigger a legitimate repository event. The affected event path may then add a Location for that repository even though scheduled discovery excludes it. This issue is fixed in version 0.5.15. | ||||
| CVE-2026-106462 | 1 Backstage | 7 Backstage, Plugin-scaffolder-backend, Plugin-scaffolder-backend-module-azure and 4 more | 2026-10-09 | 6.4 Medium |
| Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enforce intended credential boundaries. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading. | ||||
| CVE-2026-106463 | 1 Backstage | 2 Backstage, Plugin-catalog-backend-module-gitlab | 2026-10-09 | 5.4 Medium |
| Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package is affected by improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user. This issue is fixed in version 0.8.7. | ||||
| CVE-2026-106489 | 1 Backstage | 2 Backstage, Plugin-techdocs-backend | 2026-10-09 | 6.5 Medium |
| Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design. This issue is fixed in version 2.2.4. | ||||
| CVE-2026-106492 | 1 Backstage | 2 Backend-defaults, Backstage | 2026-10-09 | 7.6 High |
| Backstage is an open framework for building developer portals. Prior to 0.16.1 and 0.17.8, the @backstage/backend-defaults package is affected by improper preservation of access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths. This could allow a restricted service to perform operations beyond its intended scope, including write operations on plugins it was restricted to read-only access for. This issue is fixed in versions 0.16.1 and 0.17.8. | ||||
| CVE-2026-103323 | 1 Wordpress-extensions | 1 Integration For Epos Now And Woocommerce | 2026-10-09 | 5.9 Medium |
| The Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints, allowing unauthenticated users to retrieve the site's scheduled background tasks and their arguments, which include order identifiers and, when WooCommerce's deferred emails feature is enabled, the plaintext passwords of newly registered customers. | ||||
| CVE-2026-104667 | 1 Wordpress-extensions | 1 Animated Number Counters | 2026-10-09 | 6.8 Medium |
| The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read arbitrary data including password hashes. | ||||
| CVE-2026-104953 | 1 Wordpress-extensions | 1 Mpg | 2026-10-09 | 6.8 Medium |
| The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes. | ||||
| CVE-2026-82211 | 1 Wordpress-extensions | 1 Nexi Xpay Build | 2026-10-09 | 8.2 High |
| The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest buyers' details. | ||||
| CVE-2026-102782 | 1 Ordasoft.com | 1 Ordasoft Simple Membership Extension For Joomla | 2026-10-09 | N/A |
| Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches task=checkLoginPass with no authentication or access control check of any kind. The handler reads a login request parameter through Joomla’s generic, non-sanitizing input filter, which strips HTML/script tags but never touches quotes or SQL syntax, and concatenates it directly into a query string with no escaping or parameterization: | ||||
| CVE-2026-92393 | 1 Apache | 1 Yunikorn | 2026-10-09 | N/A |
| Apache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in YuniKorn are defined as the following Kubernetes objects: "deployments", "replicasets", "statefulsets", "daemonsets", "jobs", "cronjobs". The CREATE action correctly enforces the checks for all object types. The bypass allows any user to specify an arbitrary user info annotation. The same bypass also allows changing the application ID for the workload. The combination of the two applied in one UPDATE could allow access to a queue that the user normally would not have access to. Quota usage for the queue might be impacted if the application runs in the incorrect queue. User based quota enforcement is also based on the user annotation. User quota tracking could be side stepped even if the application runs in the correct queue. Users are recommended to upgrade to version 1.10.0, which fixes this issue. | ||||
| CVE-2026-42721 | 2 Servit Software Solutions, Wordpress-extensions | 2 Affiliate-toolkit, Affiliate-toolkit | 2026-10-09 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Blind SQL Injection.This issue affects affiliate-toolkit: from n/a through 3.9.1. | ||||
| CVE-2026-42720 | 2 Sarah Giles, Wordpress-extensions | 2 Dynamic User Directory, Dynamic User Directory | 2026-10-09 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dynamic-user-directory allows Blind SQL Injection.This issue affects Dynamic User Directory: from n/a through 2.4. | ||||
| CVE-2026-103668 | 1 Six Apart | 4 Movable Type, Movable Type Cloud Edition, Movable Type Premium and 1 more | 2026-10-09 | N/A |
| An SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary SQL query on the affected product. | ||||