Lucene search
+L

6286373 matches found

NVD
NVD
added 2026/09/15 2:16 a.m.0 views

CVE-2026-91774

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

5.3CVSS
SaveExploits0References5
NVD
NVD
added 2026/09/15 2:16 a.m.0 views

CVE-2026-91773

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

5.3CVSS
SaveExploits0References5
NVD
NVD
added 2026/09/15 2:16 a.m.0 views

CVE-2026-90850

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used...

4.8CVSS
SaveExploits0References6
NVD
NVD
added 2026/09/15 2:16 a.m.0 views

CVE-2026-91772

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

6.1CVSS
SaveExploits0References5
NVD
NVD
added 2026/09/15 2:16 a.m.1 views

CVE-2026-91770

IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any colleague's HR records. Attackers can substitute arbitrary employee IDs in skill, education, certification, language, leave, attendance, and status endpoint...

7.1CVSS
SaveExploits0References6
NVD
NVD
added 2026/09/15 2:16 a.m.0 views

CVE-2026-91771

Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download...

8.8CVSS
SaveExploits0References6
NVD
NVD
added 2026/09/15 2:16 a.m.0 views

CVE-2026-90851

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be...

6.5CVSS
SaveExploits0References6
NVD
NVD
added 2026/09/15 2:16 a.m.1 views

CVE-2026-90848

A weakness has been identified in Governikus AusweisApp up to 2.5.4. Affected is an unknown function of the component StartPAOSResponse Handler. Executing a manipulation of the argument ResultMessage can lead to cross site scripting. The attack can be launched remotely. Upgrading to version 2.5.5...

5.3CVSS
SaveExploits0References5
NVD
NVD
added 2026/09/15 2:16 a.m.0 views

CVE-2026-90849

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

7.5CVSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/09/15 2:00 a.m.1 views

CVE-2026-90851 PHPGurukul Hostel Management System checklogin.php access control

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be...

6.5CVSS
SaveExploits0References6
CVE
CVE
added 2026/09/15 2:00 a.m.1 views

CVE-2026-90851

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be...

6.5CVSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/15 1:45 a.m.1 views

CVE-2026-90850 PHPGurukul Hostel Management System manage-students.php cross site scripting

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used...

4.8CVSS
SaveExploits0References6
CVE
CVE
added 2026/09/15 1:45 a.m.1 views

CVE-2026-90850

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used...

4.8CVSS
SaveExploits0References6
CVE
CVE
added 2026/09/15 1:30 a.m.3 views

CVE-2026-90849

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

7.5CVSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/09/15 1:30 a.m.3 views

CVE-2026-90849 SourceCodester College Notes Gallery Management System login.php sql injection

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

7.5CVSS
SaveExploits0References7
Cvelist
Cvelist
added 2026/09/15 1:20 a.m.2 views

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

5.3CVSS
SaveExploits0References5
CVE
CVE
added 2026/09/15 1:20 a.m.3 views

CVE-2026-91774

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

5.3CVSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/15 1:20 a.m.2 views

CVE-2026-91773 Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

5.3CVSS
SaveExploits0References5
CVE
CVE
added 2026/09/15 1:20 a.m.2 views

CVE-2026-91773

Soft Serve versions 0.7.1 through 0.11.6 fail to scope Git LFS lock queries by repository, allowing authenticated users to read lock metadata from repositories they cannot access. Attackers with write access to any repository can enumerate lock IDs globally to recover locked file paths, usernames...

5.3CVSS
SaveExploits0References5
Cvelist
Cvelist
added 2026/09/15 1:20 a.m.2 views

CVE-2026-91772 Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

6.1CVSS
SaveExploits0References5
Rows per page
Query Builder