cve.bz

Matching records, newest first, page 15

Filter
  1. 9.8CVE-2026-107057EPSS 0.4%

    An issue in AndBible versionCode 1111 allows attackers to execute arbitrary code via uploading a crafted module zip.

  2. 9.1CVE-2026-107056EPSS 0.3%

    Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database via a crafted SEND message.

  3. 9.1CVE-2026-107053EPSS 0.4%

    Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox.

  4. 9.8CVE-2026-107050EPSS 0.5%

    An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in their uid, leading to arbitrary code execution.

  5. 9.8CVE-2026-107048EPSS 0.5%

    An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request.

  6. 9.1CVE-2026-107045EPSS 0.3%

    Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.

  7. 9.1CVE-2026-107043EPSS 0.3%

    Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism.

  8. 9.8CVE-2026-93680ExploitEPSS 2.2%

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication.

  9. 9.9CVE-2026-90868EPSS 1.5%

    An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution under certain configurations.

  10. 9.1CVE-2026-90866EPSS 0.7%

    A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote…

  11. 9.0CVE-2026-90865EPSS 1.1%

    An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbitrary command execution with elevated privileges under certain configurations.

  12. 9.1CVE-2026-90864EPSS 0.5%

    A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope.

  13. 9.1CVE-2026-90863EPSS 0.7%

    Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling a…

  14. 10.0CVE-2026-84295EPSS 0.6%

    Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

  15. 9.8CVE-2026-62131EPSS 0.3%

    Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

  16. 9.8CVE-2026-62018EPSS 0.4%

    Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

  17. 9.8CVE-2026-62017EPSS 0.4%

    Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

  18. 9.8CVE-2026-62016EPSS 0.4%

    Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

  19. 9.8CVE-2026-62015EPSS 0.4%

    Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

  20. 9.8CVE-2026-62014EPSS 0.4%

    Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

  21. 9.8CVE-2026-62013EPSS 0.4%

    Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

  22. 9.8CVE-2026-62012EPSS 0.4%

    Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

  23. 9.8CVE-2026-62011EPSS 0.4%

    Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

  24. 9.8CVE-2026-62010EPSS 0.4%

    Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

  25. 9.8CVE-2026-62009EPSS 0.4%

    Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

  26. 9.8CVE-2026-62008EPSS 0.4%

    Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

  27. 9.8CVE-2026-62006EPSS 0.4%

    Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

  28. 9.8CVE-2026-62005EPSS 0.4%

    Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

  29. 9.8CVE-2026-62004EPSS 0.4%

    Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

  30. 9.8CVE-2026-62003EPSS 0.4%

    Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

  31. 9.8CVE-2026-62002EPSS 0.5%

    Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

  32. 9.8CVE-2026-62001EPSS 0.5%

    Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

  33. 9.8CVE-2026-61998EPSS 0.5%

    Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

  34. 9.8CVE-2026-61997EPSS 0.5%

    Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

  35. 9.8CVE-2026-61992EPSS 0.4%

    Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

  36. 10.0CVE-2026-61991EPSS 0.7%

    Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

  37. 9.8CVE-2026-54860EPSS 0.5%

    Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

  38. 9.8CVE-2026-54859EPSS 0.5%

    Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

  39. 9.8CVE-2026-54858EPSS 0.5%

    Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

  40. 9.8CVE-2026-54857EPSS 0.5%

    Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

  41. 9.8CVE-2026-54856EPSS 0.5%

    Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

  42. 9.8CVE-2026-18894EPSS 0.5%

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the…

  43. 9.4CVE-2026-119145EPSS 0.8%

    Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to …

  44. 9.1CVE-2026-119128EPSS 0.3%

    ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid veri…

  45. 9.2CVE-2026-112256EPSS 0.2%

    Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.…

  46. 9.3CVE-2026-111732EPSS 0.4%

    P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the number of bytes to copy into a fixed-size …

  47. 9.8CVE-2026-110186EPSS 0.6%

    IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

  48. 9.1CVE-2026-107040EPSS 0.3%

    Insecure permissions in MBasov OMN-Go versionCode 26080824 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of data flow.

  49. 9.1CVE-2026-107038EPSS 0.4%

    Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data.

  50. 9.1CVE-2026-107034EPSS 0.4%

    Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.