Export limit exceeded: 416191 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416191 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-127084 | 1 Teableio | 1 Teable | 2026-11-14 | 7.3 High |
| Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, served inline with an empty Content-Security-Policy, to run script with the victim's session and perform API actions. | ||||
| CVE-2026-127083 | 1 Huginn | 1 Huginn | 2026-11-14 | 6.4 Medium |
| Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.configure! applies the egress proxy only to Faraday and Typhoeus. Authenticated users can configure JiraAgent or WeiboPublishAgent to send HTTParty, open-uri or Net::HTTP requests directly to internal services, with JiraAgent returning response data as events. | ||||
| CVE-2026-127082 | 1 Huginn | 1 Huginn | 2026-11-14 | 7.7 High |
| Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to read the server process environment because the jq child process inherits it. Attackers who can create, configure or dry-run a JqAgent can supply a filter using env or $ENV to disclose APP_SECRET_TOKEN, database, SMTP and OAuth secrets. | ||||
| CVE-2026-126955 | 2 Glance Project, Glanceapp | 2 Glance, Glance | 2026-11-14 | 5.3 Medium |
| Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names. | ||||
| CVE-2026-126949 | 1 Diced | 1 Zipline | 2026-11-14 | N/A |
| Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that allows authenticated users to overwrite existing uploads by supplying unsanitized names. Attackers can submit names like ../uploads/victim.txt that bypass the raw-string database uniqueness check but normalize via path.join(), causing fs.rename() to replace other files' contents. | ||||
| CVE-2026-126948 | 1 Diced | 1 Zipline | 2026-11-14 | 8.8 High |
| Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make it public, enable uploads, or delete it. | ||||
| CVE-2026-126947 | 1 Diced | 1 Zipline | 2026-11-14 | 5.4 Medium |
| Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled URLs as destinations, causing visitors of the trusted short link to be redirected to phishing or malware pages. | ||||
| CVE-2026-126946 | 1 Diced | 1 Zipline | 2026-11-14 | 5.4 Medium |
| Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages. | ||||
| CVE-2026-126945 | 1 Diced | 1 Zipline | 2026-11-14 | 8.7 High |
| Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf. | ||||
| CVE-2026-126944 | 1 Diced | 1 Zipline | 2026-11-14 | 5.7 Medium |
| Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process. | ||||
| CVE-2026-126943 | 1 Diced | 1 Zipline | 2026-11-14 | 4.9 Medium |
| Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variable values, such as OAUTH_OIDC_CLIENT_SECRET, without redaction at startup. Attackers with access to system journal or docker logs can obtain OAuth2 client secrets and use them to exchange intercepted OAuth2 callbacks for valid tokens. | ||||
| CVE-2026-126942 | 1 Diced | 1 Zipline | 2026-11-14 | 5.4 Medium |
| Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder seeded with them, disclosing victims' file URLs and removing those files from their folder views. | ||||
| CVE-2026-82978 | 1 Revive | 1 Adserver | 2026-11-14 | N/A |
| An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule set belonging to another agency by changing the submitted agencyid parameter. The server trusts the submitted agency identifier when inserting the new rule set, allowing unauthorized creation of objects in another agency's account. The issue is fixed in Revive Adserver 6.0.9 by obtaining the agency identifier from the authenticated account rather than submitted form data and removing the agency identifier from the form's hidden fields. | ||||
| CVE-2026-86343 | 1 Synology | 1 Diskstation Manager | 2026-11-14 | 6.8 Medium |
| An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks. | ||||
| CVE-2026-85098 | 1 Synology | 1 Diskstation Manager | 2026-11-14 | 5.3 Medium |
| A reachable assertion vulnerability in the synoscgi in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct limited denial-of-service attacks. | ||||
| CVE-2026-85101 | 1 Synology | 1 Diskstation Manager | 2026-11-14 | 8.6 High |
| An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69057-13, 7.2.2-72806-10, 7.3.2-86009-5, and 7.4.1-90080-1 allows remote attackers to read specific files, write arbitrary files, and conduct limited denial-of-service attacks. | ||||
| CVE-2026-126940 | 1 Diced | 1 Zipline | 2026-11-14 | 6.5 Medium |
| Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by varying query strings or supplying the x-zipline-p-filename header. Attackers can append differing query parameters to login and file or short-link password verification endpoints to perform credential guessing beyond the intended rate limits. | ||||
| CVE-2026-126938 | 1 Diced | 1 Zipline | 2026-11-14 | 7.1 High |
| Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with large declared offsets, causing the server to create oversized files and exhaust disk space. | ||||
| CVE-2026-126937 | 1 Diced | 1 Zipline | 2026-11-14 | 8.1 High |
| Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneous requests with spoofed X-Forwarded-For headers during the argon2 hashing window to gain full administrative control of the instance. | ||||
| CVE-2026-77873 | 1 Lenovo | 1 System Update | 2026-11-14 | 7.3 High |
| An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute code with elevated privileges. | ||||