Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
71,167 matching · page 117/1424Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-110209(opens NVD record) | Medium | 6.5 | Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform. | Oct 13, 2026 |
| CVE-2026-110208(opens NVD record) | High | 7.1 | Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to /systemConfig/ai/test, forwarding the stored key to their host. | Oct 13, 2026 |
| CVE-2026-110207(opens NVD record) | High | 8.8 | Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST requests to /managerUser/updateUser to reset the admin account's password and assign themselves the "all" role, achieving full administrator account takeover. | Oct 13, 2026 |
| CVE-2026-110206(opens NVD record) | High | 8.8 | Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection can submit commands like $(echo touch /tmp/x) that pass the echo allowlist check, causing the shell to execute the output without user approval. | Oct 13, 2026 |
| CVE-2026-110205(opens NVD record) | High | 8.8 | Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted prefixes, executing denied commands without user approval when auto-approval is enabled. | Oct 13, 2026 |
| CVE-2026-110204(opens NVD record) | High | 8.8 | Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can embed denied commands inside an allowlisted command like echo to execute them without user approval on bash 5.3+ or ksh93. | Oct 13, 2026 |
| CVE-2026-110203(opens NVD record) | High | 8.8 | Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or single-quoted double quotes to hide command separators behind allowlisted prefixes like echo, executing commands without user approval. | Oct 13, 2026 |
| CVE-2026-110202(opens NVD record) | High | 8.8 | Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the allowlist match a redirect target like echo while the shell runs the denied command on the developer machine. | Oct 13, 2026 |
| CVE-2026-110130(opens NVD record) | Critical | 10.0 | Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js, including /api/* routes, and the user-mutation handlers fail open for unauthenticated callers. Unauthenticated remote attackers can send a PUT request to /api/users/<id>.js to reset the admin's or any user's password and take over the account. | Oct 13, 2026 |
| CVE-2026-110112(opens NVD record) | High | 8.1 | Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp claims are not validated. Attackers with admin rights in another tenant of a shared provider like Microsoft Entra ID can recreate the mapped admin group and log in as Dockhand administrators. | Oct 13, 2026 |
| CVE-2026-110111(opens NVD record) | High | 7.5 | Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution. | Oct 13, 2026 |
| CVE-2026-110036(opens NVD record) | Low | 3.3 | A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate. | Oct 13, 2026 |
| CVE-2026-109453(opens NVD record) | High | 7.0 | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-109429(opens NVD record) | High | 8.8 | Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session. | Oct 13, 2026 |
| CVE-2026-109428(opens NVD record) | High | 8.8 | Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands. | Oct 13, 2026 |
| CVE-2026-108471(opens NVD record) | High | 8.8 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108468(opens NVD record) | High | 7.0 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108467(opens NVD record) | High | 8.8 | Heap-based buffer overflow in Microsoft PostScript Printer Driver allows an authorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-108466(opens NVD record) | Medium | 5.3 | Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network. | Oct 13, 2026 |
| CVE-2026-108465(opens NVD record) | High | 7.0 | Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108464(opens NVD record) | High | 7.0 | Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108463(opens NVD record) | High | 8.8 | Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. | Oct 13, 2026 |
| CVE-2026-108462(opens NVD record) | Medium | 5.5 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally. | Oct 13, 2026 |
| CVE-2026-108461(opens NVD record) | High | 7.0 | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108460(opens NVD record) | High | 8.1 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-108458(opens NVD record) | High | 8.8 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-108457(opens NVD record) | High | 8.1 | Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-108400(opens NVD record) | High | 8.8 | Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | Oct 13, 2026 |
| CVE-2026-108399(opens NVD record) | High | 7.2 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108398(opens NVD record) | High | 8.8 | Untrusted search path in .NET Framework allows an authorized attacker to bypass a security feature locally. | Oct 13, 2026 |
| CVE-2026-108396(opens NVD record) | High | 7.0 | Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108136(opens NVD record) | High | 7.8 | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108135(opens NVD record) | High | 7.0 | Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108134(opens NVD record) | High | 7.0 | Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108133(opens NVD record) | High | 7.8 | Release of invalid pointer or reference in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108132(opens NVD record) | High | 7.0 | Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108131(opens NVD record) | High | 7.5 | No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | Oct 13, 2026 |
| CVE-2026-108130(opens NVD record) | High | 7.8 | Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-108129(opens NVD record) | Medium | 6.5 | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | Oct 13, 2026 |
| CVE-2026-108128(opens NVD record) | Medium | 6.5 | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | Oct 13, 2026 |
| CVE-2026-108127(opens NVD record) | Medium | 6.5 | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | Oct 13, 2026 |
| CVE-2026-107607(opens NVD record) | Medium | 6.2 | SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication. | Oct 13, 2026 |
| CVE-2026-107606(opens NVD record) | Medium | 6.2 | SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication. | Oct 13, 2026 |
| CVE-2026-107605(opens NVD record) | Medium | 6.2 | SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication. | Oct 13, 2026 |
| CVE-2026-106625(opens NVD record) | High | 7.8 | Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | Oct 13, 2026 |
| CVE-2026-105733(opens NVD record) | High | 8.8 | Improper access control in Windows Hyper-V allows an authorized attacker to execute code locally. | Oct 13, 2026 |
| CVE-2026-105732(opens NVD record) | High | 7.3 | Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-105731(opens NVD record) | Medium | 5.5 | Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally. | Oct 13, 2026 |
| CVE-2026-105729(opens NVD record) | High | 7.1 | Untrusted pointer dereference in SysInternals allows an authorized attacker to elevate privileges locally. | Oct 13, 2026 |
| CVE-2026-105728(opens NVD record) | High | 7.5 | Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network. | Oct 13, 2026 |