Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
43,385 matching · page 154/868Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-73563(opens NVD record) | Medium | 4.7 | Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and the auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns and allowedRedirectUriPatterns options. A hostname wildcard can match across URL component boundaries, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. Patterns without an explicit protocol can match unintended protocols, and redirect URIs containing embedded credentials are accepted after user information is stripped for matching. The features are experimental and disabled by default; only deployments that enable them and configure custom wildcard-hostname or protocol-less patterns are affected. This issue is first fixed in prerelease version 0.29.2. | Aug 13, 2026 |
| CVE-2026-73562(opens NVD record) | Medium | 6.5 | Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOne(filter, req.body) can exploit Mongoose update casting with a __proto__.x dotted path under $set. Schema.prototype.path and Schema.prototype._getPathType can treat inherited properties of schema.paths and schema.nested as schema types, allowing the casting process to set $fullPath and $parentSchemaDocArray on Object.prototype before throwing. This prototype pollution makes those properties visible on newly created objects and can cause application integrity and availability impacts. This issue is fixed in versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2. | Aug 13, 2026 |
| CVE-2026-73561(opens NVD record) | High | 7.5 | Hub is a Node.js WebSocket server and client with added features. Prior to 0.2.16, every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners to call requestClientId, which calls rpc.send for the get-client-id action and pushes a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated because the socket close path does not cancel them. Repeated connections therefore cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. This issue is fixed in version 0.2.16. | Aug 13, 2026 |
| CVE-2026-72741(opens NVD record) | High | 8.1 | Rainbond through 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates. | Aug 13, 2026 |
| CVE-2026-67614(opens NVD record) | Critical | 9.8 | CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell. | Aug 13, 2026 |
| CVE-2026-67613(opens NVD record) | Medium | 4.9 | CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files. | Aug 13, 2026 |
| CVE-2026-19730(opens NVD record) | Medium | 4.2 | The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker. The vulnerable code paths are in pkg/domain/infra/abi/quadlet.go (lines 338-360, O_CREATE|O_WRONLY without O_TRUNC) and vendor/go.podman.io/storage/pkg/fileutils/reflink_linux.go (lines 12-19, non-truncating io.Copy fallback). | Aug 13, 2026 |
| CVE-2026-18428(opens NVD record) | High | 8.8 | A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint. | Aug 13, 2026 |
| CVE-2026-12908(opens NVD record) | Unscored | — | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | Aug 13, 2026 |
| CVE-2026-12236(opens NVD record) | Medium | 6.5 | The Bluetooth host GATT client function parse_read_std_char_desc() in subsys/bluetooth/host/gatt.c parses an ATT Read By Type Response received from a remote GATT server during BT_GATT_DISCOVER_STD_CHAR_DESC discovery. The per-entry stride rsp->len is taken directly from the peer's PDU, and the parse loop both tests its exit condition (length >= rsp->len) and advances (length -= rsp->len, pdu += rsp->len) using that value. The minimum value of rsp->len was never validated before the loop. A malicious or malfunctioning peer can reply with rsp->len = 0. Because length is unsigned and never decreases, the loop condition stays true forever and the read pointer never advances; as long as the body is at least a few bytes with a non-zero handle and a matching descriptor UUID, the host repeatedly re-parses the same bytes and invokes the discovery callback, never terminating. This hangs the Bluetooth host processing thread (CWE-835, loop with unreachable exit condition). The condition is reachable by any connected peer once the local device initiates standard-descriptor-value discovery; GATT discovery does not require bonding or encryption, so an unauthenticated adjacent attacker that the device connects to can trigger it. The impact is denial of service of the Bluetooth subsystem (and likely a watchdog reset on constrained targets); there is no memory disclosure or corruption. The fix adds a rsp->len < sizeof(struct bt_att_data) check before the loop, rejecting under-length responses so the stride is always non-zero and the loop terminates. The sibling parsers parse_include() and parse_characteristic() already validated rsp->len and are unaffected. | Aug 13, 2026 |
| CVE-2024-58374(opens NVD record) | High | 7.5 | Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC). | Aug 13, 2026 |
| CVE-2019-25765(opens NVD record) | High | 7.5 | ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC). | Aug 13, 2026 |
| CVE-2026-73266(opens NVD record) | High | 7.1 | A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels. This allows the tenant to force a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters. | Aug 13, 2026 |
| CVE-2026-59765(opens NVD record) | High | 7.5 | SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | Aug 13, 2026 |
| CVE-2026-59763(opens NVD record) | Medium | 4.3 | Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads | Aug 13, 2026 |
| CVE-2026-59109(opens NVD record) | High | 8.8 | SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592. | Aug 13, 2026 |
| CVE-2026-58511(opens NVD record) | Low | 2.7 | Webhook Authorization Header Returned in Plaintext via API | Aug 13, 2026 |
| CVE-2026-58510(opens NVD record) | Medium | 4.3 | GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | Aug 13, 2026 |
| CVE-2026-58508(opens NVD record) | Critical | 9.1 | Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) | Aug 13, 2026 |
| CVE-2026-58507(opens NVD record) | Medium | 5.3 | Private Repository Existence Disclosure via go-get Meta Endpoint | Aug 13, 2026 |
| CVE-2026-58445(opens NVD record) | Low | 2.7 | Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | Aug 13, 2026 |
| CVE-2026-58444(opens NVD record) | Medium | 4.3 | Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | Aug 13, 2026 |
| CVE-2026-58443(opens NVD record) | Critical | 9.1 | Public-only repository tokens can update private PR head branches | Aug 13, 2026 |
| CVE-2026-58442(opens NVD record) | Medium | 6.5 | Repository migration SSRF via multi-answer DNS allow-list bypass | Aug 13, 2026 |
| CVE-2026-58441(opens NVD record) | Medium | 6.3 | SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL | Aug 13, 2026 |
| CVE-2026-58440(opens NVD record) | Medium | 6.8 | Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) | Aug 13, 2026 |
| CVE-2026-58439(opens NVD record) | High | 8.1 | Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag | Aug 13, 2026 |
| CVE-2026-58438(opens NVD record) | High | 7.5 | Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access | Aug 13, 2026 |
| CVE-2026-58437(opens NVD record) | High | 7.1 | Repository Visibility Manipulation via Git Push Options | Aug 13, 2026 |
| CVE-2026-58436(opens NVD record) | High | 7.5 | ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests | Aug 13, 2026 |
| CVE-2026-58435(opens NVD record) | Medium | 5.4 | Gitea LFS Deploy-Key Privilege Escalation | Aug 13, 2026 |
| CVE-2026-58434(opens NVD record) | High | 7.5 | Private Repository Metadata Remains Accessible After Access Revocation | Aug 13, 2026 |
| CVE-2026-58433(opens NVD record) | Critical | 9.1 | Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting | Aug 13, 2026 |
| CVE-2026-58432(opens NVD record) | Medium | 5.9 | Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea | Aug 13, 2026 |
| CVE-2026-58431(opens NVD record) | Medium | 4.3 | Public-only API token restriction is not enforced on team API routes | Aug 13, 2026 |
| CVE-2026-58429(opens NVD record) | Medium | 4.9 | Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | Aug 13, 2026 |
| CVE-2026-58428(opens NVD record) | Medium | 6.5 | Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) | Aug 13, 2026 |
| CVE-2026-58427(opens NVD record) | High | 7.5 | Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | Aug 13, 2026 |
| CVE-2026-58425(opens NVD record) | Medium | 4.3 | OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation) | Aug 13, 2026 |
| CVE-2026-58420(opens NVD record) | Medium | 4.4 | Local File Inclusion via file:// URI in Migration Restore | Aug 13, 2026 |
| CVE-2026-58417(opens NVD record) | High | 7.5 | REST API exposes organization membership of private organizations to public | Aug 13, 2026 |
| CVE-2026-58416(opens NVD record) | High | 7.1 | Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | Aug 13, 2026 |
| CVE-2026-58314(opens NVD record) | High | 7.7 | Two SSRF findings in Gitea 1.26.2 | Aug 13, 2026 |
| CVE-2026-57897(opens NVD record) | Medium | 6.5 | Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs | Aug 13, 2026 |
| CVE-2026-57894(opens NVD record) | High | 8.5 | Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration | Aug 13, 2026 |
| CVE-2026-57886(opens NVD record) | Medium | 5.9 | Cross-repository issue/comment attachment re-linking can expose private attachment content | Aug 13, 2026 |
| CVE-2026-56755(opens NVD record) | Medium | 6.2 | Denial of Service (CPU & Memory Exhaustion) via O(N^2) String Concatenation in Debian Package Upload | Aug 13, 2026 |
| CVE-2026-56750(opens NVD record) | Critical | 9.1 | Gitea Remember-Me Token Theft Not Invalidating Attacker Session | Aug 13, 2026 |
| CVE-2026-56657(opens NVD record) | Medium | 6.2 | Gitea SSH Key Parser Denial of Service | Aug 13, 2026 |
| CVE-2026-56654(opens NVD record) | Critical | 9.8 | Privilege Escalation via Access Token Scope Escalation in API | Aug 13, 2026 |