Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
154,717 matching · page 148/3095Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-108643(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dictionary entries via DELETE /sys/category/deleteBatch. Attackers can obtain node ids from the unguarded rootList and childList endpoints and submit them to recursively delete entire sys_category subtrees, breaking dependent forms and dictionary fields. | Oct 10, 2026 |
| CVE-2026-108642(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients. | Oct 10, 2026 |
| CVE-2026-108641(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the getOne handler of SysAnnouncementSendController. Attackers can obtain delivery record ids from the unguarded /sys/sysAnnouncementSend/list endpoint and supply them as the sendId parameter to retrieve message titles, bodies, senders and recipients. | Oct 10, 2026 |
| CVE-2026-108640(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations. Low-privileged authenticated attackers can request GET /sys/sysDepartRole/queryById with any id to read department role names, codes, descriptions and audit fields. | Oct 10, 2026 |
| CVE-2026-108639(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to permanently delete data dictionaries via the deletePhysic handler of SysDictController. Low-privileged attackers can send DELETE requests to /sys/dict/deletePhysic/{id} to irreversibly remove active dictionaries and all their items, bypassing the recycle bin. | Oct 10, 2026 |
| CVE-2026-108638(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group memberships via the deleteGroupUser handler in SysUserController. Attackers can send DELETE requests with arbitrary groupId and userId values to remove any user from any administrator-maintained user group without ownership or tenant checks. | Oct 10, 2026 |
| CVE-2026-108637(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma-separated userIds to delete sys_ugroup_user rows without permission or tenant checks, tampering with administrator-maintained groups. | Oct 10, 2026 |
| CVE-2026-108636(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook to POST /sys/sysDepart/appImportExcel to create arbitrary sys_depart records in the administrator-maintained department tree. | Oct 10, 2026 |
| CVE-2026-108635(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can enumerate departId values to retrieve staff names, avatars, posts, and mobile and telephone numbers, including contacts marked hidden. | Oct 10, 2026 |
| CVE-2026-108634(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit them in the ids parameter to remove menus and buttons departments can grant to their roles. | Oct 10, 2026 |
| CVE-2026-108633(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, permissionId and dataRuleIds fields to attach menu, button and data rule grants to any department for delegation to its roles. | Oct 10, 2026 |
| CVE-2026-108632(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GET /sys/sysDepartPermission/queryById with arbitrary ids to retrieve depart_id, permission_id and data_rule_ids for any department. | Oct 10, 2026 |
| CVE-2026-108631(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row ids from the unguarded list endpoint and send DELETE requests with the id parameter to remove menus or buttons departments can grant their roles. | Oct 10, 2026 |
| CVE-2026-108630(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can obtain row ids from the unguarded list endpoint and overwrite depart_id, permission_id and data_rule_ids to alter which menus and data rules departments may delegate. | Oct 10, 2026 |
| CVE-2026-108629(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send departId, permissionId and dataRuleIds to POST /sys/sysDepartPermission/datarule to change, add or clear data rules on any department-menu permission binding. | Oct 10, 2026 |
| CVE-2026-108628(opens NVD record) | High | 8.1 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attackers can submit roleId and permissionIds values to grant arbitrary menu or button permissions, escalating privileges or revoking other users' permissions. | Oct 10, 2026 |
| CVE-2026-108627(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{permissionId}/{roleId} to read rule names, columns, conditions, values and bound rule ids for any role. | Oct 10, 2026 |
| CVE-2026-108626(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids to GET /sys/message/sysMessage/queryById to disclose message content and receiver addresses of other users. | Oct 10, 2026 |
| CVE-2026-108625(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming any sys_sms record id to overwrite its title, content, receiver address and send status without ownership checks. | Oct 10, 2026 |
| CVE-2026-108624(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the unguarded list endpoint and submit them to deleteBatch to remove any message push records, including pending queued messages. | Oct 10, 2026 |
| CVE-2026-108623(opens NVD record) | High | 7.1 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request with ids set to allclear to wipe the entire sys_log table, erasing all users' audit trails. | Oct 10, 2026 |
| CVE-2026-108622(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /sys/log/list endpoint and delete chosen sys_log records to erase traces of their actions. | Oct 10, 2026 |
| CVE-2026-108621(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from the unguarded list endpoint and send PUT or POST requests to /sys/position/edit to alter position names, codes, and ranks. | Oct 10, 2026 |
| CVE-2026-108620(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separated position ids, obtained from the unguarded list endpoint, to remove all sys_position rows and orphan user-position assignments. | Oct 10, 2026 |
| CVE-2026-108619(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply comma-separated template ids from the unguarded list endpoint to delete all sys_sms_template rows, breaking template-based notifications such as workflow reminders. | Oct 10, 2026 |
| CVE-2026-108618(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the unguarded list endpoint and overwrite system notification titles and content, delivering attacker-supplied text or links to other users. | Oct 10, 2026 |
| CVE-2026-108617(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can insert arbitrary notification templates with chosen codes and content into the shared sys_sms_template library used for system, e-mail, SMS and IM notifications. | Oct 10, 2026 |
| CVE-2026-108616(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated ids to DELETE /airag/extData/deleteBatch, which lacks owner or tenant checks, deleting other users' evaluator and test-tracking records. | Oct 10, 2026 |
| CVE-2026-108615(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag/extData/delete with any id parameter to remove other users' AI evaluator or test-tracking records without owner or tenant checks. | Oct 10, 2026 |
| CVE-2026-108614(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/exportXls to download every user's airag_ext_data evaluator definitions and test-tracking records as an Excel workbook. | Oct 10, 2026 |
| CVE-2026-108613(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POST requests to /airag/app/release to obtain share tokens exposing applications to anonymous chat access, or invalidate existing share links. | Oct 10, 2026 |
| CVE-2026-108612(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /airag/word/deleteBatch with comma-separated ids to permanently delete any templates in the shared library. | Oct 10, 2026 |
| CVE-2026-108611(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /airag/word/delete with an id parameter to permanently remove any template from the shared library. | Oct 10, 2026 |
| CVE-2026-108610(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /airag/word/edit to overwrite shared templates that other users rely on to generate documents. | Oct 10, 2026 |
| CVE-2026-108609(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' AI voice generation history via the userId parameter of GET /airag/voice/listByUser. Attackers who know another user's id can retrieve submitted text-to-speech input, voice settings, timestamps, and generated audio file names and paths stored in Redis. | Oct 10, 2026 |
| CVE-2026-108608(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI voice records by supplying an arbitrary userId to DELETE /airag/voice/deleteVoiceRecord. Attackers can obtain record ids from the unchecked GET /airag/voice/listByUser endpoint and delete victims' text-to-speech history entries stored in Redis, one per request. | Oct 10, 2026 |
| CVE-2026-108607(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listByUser endpoint and delete victims' Redis-stored video history entries one record per request. | Oct 10, 2026 |
| CVE-2026-108606(opens NVD record) | Medium | 5.4 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every shared OCR prompt record stored in Redis. | Oct 10, 2026 |
| CVE-2026-108605(opens NVD record) | Medium | 4.3 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users. | Oct 10, 2026 |
| CVE-2026-97853(opens NVD record) | Unscored | — | Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places. Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument. This issue affects decimal: from 0.1.0 before 3.1.2. | Oct 10, 2026 |
| CVE-2026-81797(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | Oct 10, 2026 |
| CVE-2026-78535(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | Oct 10, 2026 |
| CVE-2026-78534(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions. | Oct 10, 2026 |
| CVE-2026-78533(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | Oct 10, 2026 |
| CVE-2026-78532(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions. | Oct 10, 2026 |
| CVE-2026-78531(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | Oct 10, 2026 |
| CVE-2026-78530(opens NVD record) | High | 7.7 | Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. | Oct 10, 2026 |
| CVE-2026-78529(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | Oct 10, 2026 |
| CVE-2026-66569(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | Oct 10, 2026 |
| CVE-2026-66568(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. | Oct 10, 2026 |