Export limit exceeded: 421045 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421045 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 26153 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421045 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421045 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421045 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118394 | 1 Gitea | 1 Gitea | 2026-11-06 | 4.3 Medium |
| The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public organizations by re-parsing the `Authorization` header as an OAuth2 access token instead of using the scope of the credential that authenticated the request. When a public-only OAuth2 token was sent as a query parameter or form field, or a public-only personal access token was used, that scope came back empty and the claim listed the token owner's private organizations, teams and concealed memberships. The disclosure is limited to the owner's organization and team names and memberships; no repository content is exposed. The endpoint now uses the scope of the authenticating token. | ||||
| CVE-2026-74760 | 1 Perl | 1 Google::auth | 2026-11-06 | 8.8 High |
| Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then take the code from the first request to reach their loopback listener without comparing the returned state. A local attacker can submit an authorization code for their own Google account. The CLI exchanges it and stores the refresh token as the user's credentials, so the user's tools then act as the attacker's account. | ||||
| CVE-2026-90964 | 2026-11-06 | 5.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site. | ||||
| CVE-2026-90965 | 2026-11-06 | 5.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published. | ||||
| CVE-2026-90966 | 2026-11-06 | 4.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price. | ||||
| CVE-2026-107773 | 2026-11-06 | 6.5 Medium | ||
| The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders. | ||||
| CVE-2026-123492 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-11-06 | 4.9 Medium |
| SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a panic that terminates the kernel process and interrupts service. | ||||
| CVE-2026-118575 | 1 Drupal | 1 Signature Pad Widget | 2026-11-06 | 6.1 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0. | ||||
| CVE-2026-118551 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 3.1 Low |
| Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118549 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118542 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 2.7 Low |
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | ||||
| CVE-2026-114548 | 1 Drupal | 1 Imageapi Optimize Webp | 2026-11-06 | 3.7 Low |
| Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2. | ||||
| CVE-2026-114547 | 1 Drupal | 1 Tinypng | 2026-11-06 | 3.7 Low |
| Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2. | ||||
| CVE-2026-114546 | 1 Drupal | 1 Media Alias Display | 2026-11-06 | 3.7 Low |
| Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2. | ||||
| CVE-2026-114544 | 1 Drupal | 1 Media Bulk Upload | 2026-11-06 | 5.4 Medium |
| Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6. | ||||
| CVE-2026-114541 | 1 Drupal | 1 Frontend Editing | 2026-11-06 | 4.8 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3. | ||||
| CVE-2026-114540 | 1 Drupal | 1 Domain | 2026-11-06 | 6.3 Medium |
| Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2. | ||||
| CVE-2026-114539 | 1 Drupal | 1 Doccheck Basic | 2026-11-06 | 6.3 Medium |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x. | ||||
| CVE-2026-114425 | 1 Seppmail | 1 Seppmail Secure Email Gateway | 2026-11-06 | N/A |
| SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root. | ||||
| CVE-2026-123782 | 1 Zhimaai | 1 Chatwiki | 2026-11-06 | 4.3 Medium |
| ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check alongside another tenant's sequential form_field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored. | ||||