Export limit exceeded: 394962 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (394962 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82056 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-09-16 | 5.3 Medium |
| A race condition in MongoDB server's text index query parsing can cause a heap use-after-free read when handling upsert retry paths. Under certain concurrent index lifecycle operations, a raw pointer to internal text index metadata may be dereferenced after the underlying structures have been freed, leading to a server crash. An authenticated user with readWrite privileges can trigger this condition through specific concurrent text-search and index management operations, resulting in denial of service for all connected clients. This | ||||
| CVE-2026-82057 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-09-16 | 6.5 Medium |
| A security issue was discovered in MongoDB where an authenticated user with readWrite privileges could crash the mongod server process. By specifying a custom WiredTiger storage configuration option with an incompatible value during collection creation, a user could cause a type confusion in the storage engine layer. When documents were subsequently read from the misconfigured collection, the resulting mismatch in expected data format led to corrupted memory interpretation and a server crash. The crafted collection configuration persists across restarts, requiring manual operator intervention to remediate. | ||||
| CVE-2026-57098 | 1 Microsoft | 2 Remote Desktop, Remote Desktop Client | 2026-09-16 | 7.5 High |
| Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-92816 | 1 Comfy | 1 Comfyui | 2026-09-16 | 7.8 High |
| ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through modified startup files or package initializers. | ||||
| CVE-2026-92812 | 2026-09-16 | 6.8 Medium | ||
| decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root. | ||||
| CVE-2026-92811 | 1 Browserless | 1 Chrome | 2026-09-16 | 6.5 Medium |
| browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false. | ||||
| CVE-2026-92805 | 1 Uvdesk | 1 Community-skeleton | 2026-09-16 | 9.8 Critical |
| UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk controller actions. Unauthenticated attackers can repoint the database and create super administrator accounts by submitting crafted requests to wizard endpoints, gaining full control of the instance. | ||||
| CVE-2026-92804 | 2026-09-16 | 7.1 High | ||
| Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templates. Authenticated attackers can supply malicious configuration values to direct server requests at internal addresses or cloud metadata endpoints, potentially exfiltrating provider credentials. | ||||
| CVE-2026-92800 | 2026-09-16 | 6.8 Medium | ||
| Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected. | ||||
| CVE-2026-92796 | 2026-09-16 | 8.8 High | ||
| Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery. | ||||
| CVE-2026-92792 | 2026-09-16 | 7.5 High | ||
| OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key, causing the FallbackVerifier to execute unconditionally. Attackers can bypass attestation verification by including the test_purpose key in evidence and providing enrolled measure and serial number pairs from the allowlist to gain unauthorized access. | ||||
| CVE-2026-92791 | 1 Uber | 1 Kraken | 2026-09-16 | 7.5 High |
| Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process. | ||||
| CVE-2026-92787 | 2026-09-16 | 9.8 Critical | ||
| Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based access control by presenting an unverified token with a hardcoded claim value. Attackers can obtain trusted internal identity and gain unchecked read and write access to all entities, feature views, data sources, and permission policies on the server. | ||||
| CVE-2026-92786 | 2026-09-16 | 7.8 High | ||
| LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation. | ||||
| CVE-2026-92782 | 2026-09-16 | 8.1 High | ||
| Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access collections from other tenants by knowing the collection identifier. Attackers can read, modify, and update records in foreign collections by issuing requests under their own tenant path, bypassing authorization checks. | ||||
| CVE-2026-92781 | 2026-09-16 | 6.3 Medium | ||
| Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL. | ||||
| CVE-2026-92776 | 1 Requarks | 1 Wiki.js | 2026-09-16 | 8.1 High |
| Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls. | ||||
| CVE-2026-92775 | 1 Requarks | 1 Wiki.js | 2026-09-16 | 6.5 Medium |
| Wiki.js through 2.5.314 contains a server-side request forgery vulnerability in the Image Prefetch renderer that fetches arbitrary URLs without protocol, host, or address validation. Attackers with page editing permissions can inject img elements with the prefetch-candidate class to make the server request internal services and cloud metadata endpoints, with responses returned to the attacker. | ||||
| CVE-2026-92771 | 1 Twenty | 1 Twenty | 2026-09-16 | 6.5 Medium |
| Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users to bypass permission checks. Attackers with canReadObjectRecords permission but canReadFieldValue false can retrieve restricted field values through the groupBy resolver that would normally be denied. | ||||
| CVE-2026-92770 | 1 Linuxfoundation | 1 Harbor | 2026-09-16 | 6.5 Medium |
| Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts. | ||||