Matching records, newest first
Filter
- 6.3CVE-2026-112103EPSS 0.4%
A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of the component HTTP Client. Such manipulation leads to improper certificate validation. The attack m…
- 9.8CVE-2026-90910EPSS 0.5%
Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction …
- –CVE-2026-86589EPSS 0.2%
Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit…
- –CVE-2026-79633EPSS 0.2%
vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access. Users are recomm…
- –CVE-2026-79624EPSS 0.2%
Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale …
- –CVE-2026-79620EPSS 0.2%
Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to vie…
- –CVE-2026-79613EPSS 0.2%
vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could access comments associated with non-public content through public user profiles. Users are recommended to upgrade to …
- –CVE-2026-76994EPSS 0.2%
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public…
- 4.3CVE-2026-71563EPSS 0.2%
Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with h…
- –CVE-2026-68482EPSS 0.2%
Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visi…
- 5.4CVE-2026-67249EPSS 0.2%
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforc…
- –CVE-2026-64945EPSS 0.2%
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result (the unpin permission instead of the hide permission),…
- –CVE-2026-64944EPSS 0.2%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without pass…
- 8.1CVE-2026-64943EPSS 0.3%
Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-re…
- 5.3CVE-2026-112192EPSS 0.4%
MISP contains a vulnerability in the handling of module plugin settings. When the server rebuilds module-supplied settings for API consumption, it drops the redacted and cli_only flags that a module declares in its own configuration metada…
- 7.1CVE-2026-112188EPSS 0.3%
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted. The settings lookup function resolves a dotted setting name t…
- 4.8CVE-2026-112184EPSS 0.4%
MISP contains a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. Parameter names returned by the misp-modules service are rendered as raw HTML form labels on the workflow module page without output encod…
- 4.8CVE-2026-112183EPSS 0.3%
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attribu…
- 2.1CVE-2026-112102EPSS 0.3%
A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument cond…
- 2.1CVE-2026-112101EPSS 0.2%
A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulat…
- 2.0CVE-2026-112100EPSS 0.2%
A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preprocesso…
- 8.8CVE-2026-111408EPSS 0.4%
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
- 6.5CVE-2026-111407EPSS 0.2%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.
- 9.9CVE-2026-111406EPSS 0.3%
Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server.This issue affects MapSVG: from n/a through 8.16.1.
- 7.7CVE-2026-111398EPSS 0.3%
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Path Traversal.This issue affects MapSVG: from n/a through 8.16.…
- 6.4CVE-2026-110898EPSS 0.2%
Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 6.8.5.
- 9.9CVE-2026-110887EPSS 0.4%
Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote Code Inclusion.This issue affects HivePress: from n/a through 1.7.32.
- 7.1CVE-2026-110379EPSS 0.2%
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.
- –CVE-2026-108837EPSS 0.2%
Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kyli…
- –CVE-2026-108833EPSS 0.2%
Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to ver…
- –CVE-2026-108823EPSS 0.2%
Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 th…
- –CVE-2026-108780EPSS 0.2%
Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are rec…
- –CVE-2026-108776EPSS 0.2%
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue aff…
- –CVE-2026-108771EPSS 0.2%
Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are…
- –CVE-2026-108766EPSS 0.2%
Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affec…
- –CVE-2026-108764EPSS 0.2%
Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affe…
- –CVE-2026-108762EPSS 0.2%
Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue …
- 8.8CVE-2026-13695EPSS 0.2%
SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects the sInfo parameter sent via POST to the endpoint /login/ap_Login.aspx/start. Successful exploitation of this vulnerabil…
- 5.1CVE-2026-112180EPSS 0.3%
MISP contains a data integrity flaw in its event deletion logic. When a user deletes an event, several associated records are not removed from the database, leaving them as orphaned entries. The affected record types include event report t…
- 5.3CVE-2026-112179EPSS 0.3%
In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non-exportable tags was applied only once after the iteration over all reports, rather than to each in…
- 7.1CVE-2026-112178EPSS 0.2%
MISP contains an access control flaw in the proposal (shadow attribute) visibility logic. The authorization check accepted any attribute or object carrying one of the user's sharing groups without verifying the distribution level, and deni…
- 8.5CVE-2026-112161EPSS 0.08%
MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrity. A local attacker with write permissions on this file can replace the ‘bin/cygwin1.dll’ library contained within it wit…
- 2.1CVE-2026-112098EPSS 0.3%
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The attack…
- 5.1CVE-2026-112097EPSS 0.2%
A vulnerability was found in SourceCodester Inventory System 1.0. This issue affects some unknown processing of the file /api/transactions_handler.php?action=save_sale of the component Sales Management Handler. The manipulation of the argu…
- 2.0CVE-2026-112096EPSS 0.2%
A vulnerability has been found in SourceCodester Inventory System 1.0. This vulnerability affects unknown code of the file /api/transactions_handler.php?action=save_purchase of the component Purchase Records Handler. The manipulation of th…
- 2.0CVE-2026-112095EPSS 0.2%
A flaw has been found in SourceCodester Inventory System 1.0. This affects an unknown part of the file /api/products_handler.php?action=save of the component Product Management. Executing a manipulation of the argument Product_Id/Product_N…
- 6.5CVE-2026-111438EPSS 0.4%
在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求 is_node_internal_connection()，直接调用 check_hba_replication()。check_hba_replication() 仅按 replication 标记做弱匹配，缺少普通 check_hba() 中的远…
- 6.9CVE-2026-104679EPSS 0.1%
VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references. Loading a specially crafted project file may the product to initiate unintended communication, potentially leading to the leak of sensitiv…
- 2.0CVE-2026-112094EPSS 0.2%
A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.6. This affects the function mxml_load_data of the file mxml-file.c. The manipulation leads to use after free. The attack is possible to be carried out remotely. Th…
- 2.1CVE-2026-112093EPSS 0.3%
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The impacted element is an unknown function of the file feedback.php. The manipulation of the argument msg leads…