Export limit exceeded: 26371 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 14121 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14121 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16739 | 2026-08-14 | 5.9 Medium | ||
| The Epeken All Kurir for Woocommerce WordPress plugin through 2.1.2 does not verify that a payment-confirmation request originates from the owner of the targeted order, nor that any payment actually occurred, allowing unauthenticated attackers to mark arbitrary orders as confirmed and, in a non-default configuration, paid. | ||||
| CVE-2026-58429 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 4.9 Medium |
| Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | ||||
| CVE-2026-58420 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 4.4 Medium |
| Local File Inclusion via file:// URI in Migration Restore | ||||
| CVE-2026-58417 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.5 High |
| REST API exposes organization membership of private organizations to public | ||||
| CVE-2026-55984 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 2.7 Low |
| Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | ||||
| CVE-2026-17099 | 1 Ibm | 1 I | 2026-08-14 | 7.3 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to improper authentication. | ||||
| CVE-2026-66804 | 1 Microsoft | 8 Windows 10 22h2, Windows 10 22h2, Windows 11 24h2 and 5 more | 2026-08-14 | 7.8 High |
| Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-73840 | 1 Openchoreo | 1 Openchoreo | 2026-08-14 | 5.3 Medium |
| OpenChoreo is a complete, open-source developer platform for Kubernetes. Prior to 1.0.3, 1.1.3, and 1.2.0-rc.2, the POST /api/v1alpha1/autobuild endpoint in internal/openchoreo-api/api/handlers/webhook_handler.go selected a webhook provider from caller-controlled X-Event-Key, accepted Bitbucket requests without HMAC-SHA256 in X-Hub-Signature or a configured bitbucket-secret, and allowed unauthenticated build triggers for components matched by repository URL and branch, including cross-provider triggers using attacker-supplied commit SHAs. This issue is fixed in versions 1.0.3, 1.1.3, and 1.2.0-rc.2. | ||||
| CVE-2026-73664 | 1 Freepbx | 1 Backup | 2026-08-14 | N/A |
| FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorized_keys for the asterisk system user without reliably enforcing backup-only command and source restrictions. The key grants persistent shell access that can execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services. This issue is fixed in version 17.0.11. | ||||
| CVE-2026-19837 | 1 Webkul | 1 Bagisto | 2026-08-14 | 2.7 Low |
| A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | ||||
| CVE-2026-72837 | 1 Filebrowser | 1 Filebrowser | 2026-08-14 | 8.8 High |
| File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment. | ||||
| CVE-2026-72786 | 1 Craftcms | 2 Craft Cms, Craftcms | 2026-08-14 | 6.5 Medium |
| Craft CMS versions before 5.10.8 contain an authentication bypass vulnerability in the elements/save action that allows authenticated users to change passwords without verification. Attackers with edit users permission can reset any user's password including administrators by exploiting the unprotected newPassword field in the User element save flow. | ||||
| CVE-2026-68584 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 8.6 High |
| SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate. | ||||
| CVE-2026-18509 | 1 Ibm | 1 I | 2026-08-14 | 8.2 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system. | ||||
| CVE-2026-19839 | 1 Sourcecodester | 1 Simple Doctors Appointment System | 2026-08-14 | 4.7 Medium |
| A vulnerability was detected in SourceCodester Simple Doctors Appointment System 1.0. This issue affects the function save_doctor of the file /save_file.php. The manipulation results in unrestricted upload. The attack can be executed remotely. The exploit is now public and may be used. | ||||
| CVE-2026-19838 | 1 Webkul | 1 Bagisto | 2026-08-14 | 4.3 Medium |
| A security vulnerability has been detected in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/reporting/sales/ of the component Backend Reporting Endpoint. The manipulation leads to authorization bypass. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | ||||
| CVE-2026-19836 | 1 Webkul | 1 Bagisto | 2026-08-14 | 4.3 Medium |
| A security flaw has been discovered in Webkul Bagisto up to 2.4.4. Affected by this issue is some unknown functionality of the file /admin/customers/view of the component Backend Customer Detail Feature. Performing a manipulation of the argument ID results in authorization bypass. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | ||||
| CVE-2026-19784 | 2 Francoisjacquet, Rosariosis | 2 Rosariosis, Rosariosis | 2026-08-14 | 4.3 Medium |
| A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component. | ||||
| CVE-2026-19835 | 1 Webkul | 1 Bagisto | 2026-08-14 | 3.8 Low |
| A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | ||||
| CVE-2026-19834 | 1 Webkul | 1 Bagisto | 2026-08-14 | 4.7 Medium |
| A vulnerability was determined in Webkul Bagisto up to 2.4.4. Affected is an unknown function of the file /admin/customers/login-as-customer/ of the component Admin Customer Impersonation Feature. This manipulation of the argument ID causes authorization bypass. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | ||||