11560 matches found
EUVD-2026-60605
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...
CVE-2026-75841 ArcadeDB before 26.8.1 Denial of Service via range()
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...
CVE-2026-75841 ArcadeDB before 26.8.1 Denial of Service via range()
ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range expressions with large bounds to trigger OutOfMemoryError and cause temporary service degradation or...
CVE-2026-75828 Grav before 2.0.15 Stored XSS via detectXss() Quote Bypass
Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...
CVE-2026-72647
A flaw was found in Elasticsearch. An authenticated user with read privileges on a single index can submit a specially crafted search request. This request, containing deeply nested serialized data, is processed without a depth limit, leading to uncontrolled recursion. This can exhaust the thread...
tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination
A flaw was found in Apache Tomcat. This vulnerability, categorized as Insufficient Session Expiration, occurs when an authenticated HTTP session's ID is modified after a WebSocket connection has been established. Under these conditions, the WebSocket session fails to terminate as expected when th...
PT-2026-77300
Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in panel admins.ip without enforcing numeric element types. When the poisoned...
PT-2026-78244
Name of the Vulnerable Software and Affected Versions Bamboo Data Center versions 10.0.0 through 10.2.0 Bamboo Data Center version 11.0.0 Bamboo Data Center versions 12.0.0 through 12.1.0 Description An improper authorization issue allows an authenticated attacker to gain unintended access to...
NPM: 9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint
NPM: 9Router: Authenticated Server-Side Request Forgery SSRF via OIDC Provider Test Endpoint vulnerability discovered by ? in WordPress Npm 9router versions = 0.5.4...
CVE-2026-65822
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.116.0 and 16.23.0, erpnext/selling/report/inactivecustomers/inactivecustomers.py accepts an unvalidated doctype filter and interpolates it into raw SQL in getsalesdetails and getlastsalesamt, allowing an authenticate...
CVE-2026-54336 JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset
JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...
CVE-2026-54336 JumpServer: KoKo Web Terminal SFTP Path Traversal on Authorized Asset
JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit crafted traversal paths through the KoKo Web Terminal SFTP feature, causing AssetDir.GetRealPath...
EUVD-2026-60387
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information...
CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...
CVE-2026-57485
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...
CVE-2026-71486 vLLM: Derender endpoints decode caller-supplied GenerateResponse token IDs without output bounds
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generateresponses, choices, tokenids, promptlogprobs, logprobs.content, toplogprobs, a...
CVE-2026-71553
ApostropheCMS 4.32.0 and earlier is vulnerable to second-order prototype pollution: an authenticated editor sending PATCH /api/v1/article/:id with the inherited path toString.call causes apos.util.set() to overwrite Object.prototype.toString.call, crashing the entire Node.js process until restart...
CVE-2026-57485 Stirling-PDF: Internal Service Account API Key Disclosure via Pipeline Endpoint
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.9.0, the /api/v1/pipeline/handleData endpoint in app/core/src/main/java/stirling/software/SPDF/controller/api/pipeline/PipelineProcessor.java injects the STIRLING-PDF-BACKEND-API-USER API...