412574 matches found
CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added. Attackers holding an existing oxishares share-ring cookie can request content via GET /api/files/id to read shared files or folder...
CVE-2026-111343
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/id. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers,...
CVE-2026-111320
ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an unvalidated provider baseurl. Attackers can set baseurl via the provider config endpoint and trigger POST /api/v1/models/check to...
CVE-2026-111321
TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...
CVE-2026-111323
RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validateurl checks only the initial hostname. Attackers can submit a public URL that redirects or DNS-rebinds to internal addresses like cloud metadata...
CVE-2026-111312
OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/id GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medic...
CVE-2026-111322
Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to...
CVE-2026-111313
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback, private, or cloud metadata...
CVE-2026-111324
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log i...
CVE-2026-111280
snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into...
CVE-2026-111283
BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an...
CVE-2026-111284
Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holiday names rendered as HtmlString. Attackers permitted to create Public Holidays or Mandatory Days can store JavaScript payloads th...
CVE-2026-111281
Jooan JA-A12 IP cameras with firmware 00920171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen...
CVE-2026-111279
Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to...
CVE-2026-111282
Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle0x38RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer SID 0x38 request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to...
CVE-2026-111275
nifticlib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifticonvertn2hdr2nim because the NIfTI-2 dim0 value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via niftiimageread to crash applications or corrupt stack memory...
CVE-2026-111278
NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as plain text in the HTML. Attackers can fetch protected forms, extract the captchaimage value with a pattern match, and submit it to...
CVE-2026-111272
LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote that allows attackers to read past a short ShotInfo buffer. Attackers can supply a crafted Nikon NEF/TIFF with a 5-byte ShotInfo tag declaring version 243 to crash applications decoding the image...
CVE-2026-111273
unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in targetname in tar/parse-tar.c, reachable through the arentrygetname API. Attackers can supply a crafted TAR archive with a full ustar prefix and name to write a NUL byte past the allocation, corrupting heap memory and crashi...
CVE-2026-111274
unarr through 1.1.1 contains a heap-based out-of-bounds read in zipparseextrafields in zip/parse-zip.c due to an incorrect ZIP64 extra field length check. Attackers can supply a crafted ZIP archive with 0xFFFFFFFF sentinel values and a truncated ZIP64 record to read past the heap buffer and crash...
CVE-2026-111277
NivoCart through 2.5.1 contains a missing authorization vulnerability in the download action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an orderid. Attackers can iterate the orderid parameter, which matches guest orders stored with...
CVE-2026-110918
Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...
CVE-2026-110919
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110920
Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110921
Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110917
Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page. Chromium security severity: High...
CVE-2026-111269
libical through 4.0.6 contains a heap-based out-of-bounds read in icalvaluedecodeicalstring in src/libical/icalvalue.c when decoding input ending in a backslash. Attackers can supply escaped iCalendar text with a trailing backslash, causing the loop to read past the terminator and crash the...
CVE-2026-111270
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM in src/loaddsm.cpp because nPat is never checked against MAXPATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping pattlen value to corrupt heap memory and crash the...
CVE-2026-110922
Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-111271
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2 in src/loadams.cpp that allows attackers to read adjacent heap memory via crafted AMS files. Attackers can supply an AMS module whose pattern effect bytes keep bit 7 set, driving the decoder...
CVE-2026-110914
Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-110913
Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-110915
Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-110916
Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2024-58397
MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters that allows attackers to read past heap allocations via crafted QuickTime chapter samples. Attackers can supply an MP4 file whose chapter sample is shorter than its declared title length, crashing applications li...
CVE-2026-111357
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026...
CVE-2026-109468
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network...
CVE-2026-108455
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network...
CVE-2026-108453
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network...
CVE-2026-108454
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network...
CVE-2026-108447
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
CVE-2026-108448
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...
CVE-2026-108445
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
CVE-2026-108446
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network...
CVE-2026-108449
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
CVE-2026-108451
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network...
CVE-2026-108452
Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...
CVE-2026-108450
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network...