CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

7 matches found

Github Security Blog•added 2026/05/11 7:32 p.m.•1 views

MantisBT Vulnerable to Privilege Escalation from Manager to Administrator

Insufficient access control checks in ProjectUsersAddCommand used in manageprojuseradd.php and REST API endpoint PUT /project/id/users allows users having manageprojectthreshold access level manager by default to grant project-level administrator access to any user including themselves in any...

5.1CVSS5.9AI score0.00015EPSS

Exploits0References5Affected Software1

RedhatCVE•added 2026/05/08 8:21 p.m.•4 views

CVE-2026-41654

Weblate is a web based localization tool. Prior to version 5.17.1, an authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo...

8.1CVSS5.7AI score0.00021EPSS

Exploits0References1

SUSE CVE•added 2026/05/08 2:21 a.m.•5 views

SUSE CVE-2026-41654

8.1CVSS5.7AI score0.00021EPSS

Exploits0References3

NVD•added 2026/05/07 3:16 p.m.•7 views

CVE-2026-41654

8.1CVSS0.00021EPSS

Exploits0References6

Cvelist•added 2026/05/07 1:40 p.m.•25 views

CVE-2026-41654 Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

5.3CVSS0.00021EPSS

Exploits0References6

OSV•added 2026/04/30 5:28 p.m.•1 views

GHSA-CWCX-382V-8M9G Weblate Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url

Impact An authenticated user with project.add permission default on hosted Weblate SaaS and for any user holding an active billing/trial plan can import a crafted project backup ZIP whose components/.json contains an attacker-chosen repo URL pointing at a private address e.g. http://127.0.0.1:999...

5.3CVSS5.8AI score0.00021EPSS

Exploits0References8