Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
153,569 matching · page 129/3072Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-108618(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titles and content, delivering attacker-supplied text or links to other users. | Oct 10, 2026 |
| CVE-2026-108617(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes and content into the shared sys_sms_template library used for system, e-mail, SMS and IM notifications. | Oct 10, 2026 |
| CVE-2026-108616(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner or tenant checks, deleting other users' evaluator and test-tracking records. | Oct 10, 2026 |
| CVE-2026-108615(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users' AI evaluator or test-tracking records without owner or tenant checks. | Oct 10, 2026 |
| CVE-2026-108614(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airag_ext_data evaluator definitions and test-tracking records as an Excel workbook. | Oct 10, 2026 |
| CVE-2026-108613(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens exposing applications to anonymous chat access, or invalidate existing share links. | Oct 10, 2026 |
| CVE-2026-108612(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to permanently delete any templates in the shared library. | Oct 10, 2026 |
| CVE-2026-108611(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove any template from the shared library. | Oct 10, 2026 |
| CVE-2026-108610(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other users rely on to generate documents. | Oct 10, 2026 |
| CVE-2026-108609(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech input, voice settings, timestamps, and generated audio file names and paths stored in Redis. | Oct 10, 2026 |
| CVE-2026-108608(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request. | Oct 10, 2026 |
| CVE-2026-108607(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listByUser endpoint and delete victims' Redis-stored video history entries one record per request. | Oct 10, 2026 |
| CVE-2026-108606(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every shared OCR prompt record stored in Redis. | Oct 10, 2026 |
| CVE-2026-108605(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users. | Oct 10, 2026 |
| CVE-2026-97853(opens NVD record) | Unscored | — | Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places. Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument. This issue affects decimal: from 0.1.0 before 3.1.2. | Oct 10, 2026 |
| CVE-2026-81797(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | Oct 10, 2026 |
| CVE-2026-78535(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | Oct 10, 2026 |
| CVE-2026-78534(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. | Oct 10, 2026 |
| CVE-2026-78533(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | Oct 10, 2026 |
| CVE-2026-78532(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. | Oct 10, 2026 |
| CVE-2026-78531(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | Oct 10, 2026 |
| CVE-2026-78530(opens NVD record) | High | 7.7 | Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. | Oct 10, 2026 |
| CVE-2026-78529(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | Oct 10, 2026 |
| CVE-2026-66569(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | Oct 10, 2026 |
| CVE-2026-66568(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. | Oct 10, 2026 |
| CVE-2026-66567(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. | Oct 10, 2026 |
| CVE-2026-66566(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. | Oct 10, 2026 |
| CVE-2026-66565(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. | Oct 10, 2026 |
| CVE-2026-66564(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. | Oct 10, 2026 |
| CVE-2026-66563(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. | Oct 10, 2026 |
| CVE-2026-66483(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. | Oct 10, 2026 |
| CVE-2026-66482(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. | Oct 10, 2026 |
| CVE-2026-66481(opens NVD record) | Medium | 6.8 | Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions. | Oct 10, 2026 |
| CVE-2026-66480(opens NVD record) | Medium | 5.3 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0. | Oct 10, 2026 |
| CVE-2026-65459(opens NVD record) | High | 7.5 | Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. | Oct 10, 2026 |
| CVE-2026-62130(opens NVD record) | High | 7.2 | Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions. | Oct 10, 2026 |
| CVE-2026-62129(opens NVD record) | Critical | 9.9 | Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. | Oct 10, 2026 |
| CVE-2026-62125(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. | Oct 10, 2026 |
| CVE-2026-62124(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. | Oct 10, 2026 |
| CVE-2026-62123(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. | Oct 10, 2026 |
| CVE-2026-62120(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. | Oct 10, 2026 |
| CVE-2026-62118(opens NVD record) | High | 7.3 | Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | Oct 10, 2026 |
| CVE-2026-62117(opens NVD record) | High | 8.5 | Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | Oct 10, 2026 |
| CVE-2026-62116(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | Oct 10, 2026 |
| CVE-2026-62115(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. | Oct 10, 2026 |
| CVE-2026-62100(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions. | Oct 10, 2026 |
| CVE-2026-62099(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions. | Oct 10, 2026 |
| CVE-2026-62098(opens NVD record) | Medium | 6.5 | Unauthenticated Content Injection in Boutique <= 2.3.3 versions. | Oct 10, 2026 |
| CVE-2026-62096(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions. | Oct 10, 2026 |
| CVE-2026-62095(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions. | Oct 10, 2026 |