Export limit exceeded: 405606 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (405606 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109422 | 1 Netease | 1 Netease Cloud Music For Windows | 2026-10-13 | 8.1 High |
| NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplied URLs to ShellExecuteW without validating the URL scheme. An attacker able to inject content into the renderer, such as by forging the /pc/upgrade/get API response using a publicly known AES key over an unvalidated TLS connection, can invoke os.navigateExternal with a file:// URL through an img onerror payload to execute arbitrary local binaries under the logged-in user's account. | ||||
| CVE-2026-109423 | 1 Netease | 1 Netease Cloud Music For Windows | 2026-10-13 | 7.4 High |
| NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adjacent attacker to intercept and decrypt HTTPS traffic by failing to validate the server certificate chain, verify the hostname, or consult any Windows certificate trust store. Attackers can perform a man-in-the-middle attack using a rogue certificate authority to decrypt traffic, capture the MUSIC_U session credential sent in authenticated API requests, and modify server responses in transit, enabling account takeover and transport-layer response forgery. | ||||
| CVE-2026-109424 | 1 Netease | 1 Netease Cloud Music For Windows | 2026-10-13 | 5.9 Medium |
| NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge. | ||||
| CVE-2026-109425 | 1 Tink-crypto | 1 Tink-go | 2026-10-13 | 5.3 Medium |
| Tink-go (tink-crypto/tink-go) through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets() and ReadWithNoSecrets() skip the structural Validate() step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariants to be accepted. Attackers can supply a malformed keyset, such as one with an enabled public key lacking a valid primary key or a DESTROYED key with no KeyData, causing inconsistent downstream validation where functions like jwt.JWKSetFromPublicKeysetHandle() process the invalid handle and produce a JWK set, potentially misleading applications that rely on successful handle construction as proof of keyset integrity. | ||||
| CVE-2026-92116 | 1 Apache | 1 Allura | 2026-10-13 | N/A |
| OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue. | ||||
| CVE-2026-92120 | 1 Apache | 1 Allura | 2026-10-13 | N/A |
| OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue. | ||||
| CVE-2026-97691 | 1 Get-convex | 1 Convex-backend | 2026-10-13 | 4.3 Medium |
| Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex deployment. The maintainer has intentionally withheld the affected component and technical mechanism to protect self-hosted deployments that have not been updated, and no evidence of exploitation is known. Convex cloud deployments were patched automatically. This issue is fixed in the self-hosted image published on August 10, 2026 and local binary precompiled-2026-08-10-c0cb7ae. | ||||
| CVE-2026-109427 | 1 Weebzone | 1 Telegram-stremio | 2026-10-13 | 6.5 Medium |
| Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/decode_string functions. Attackers can craft or enumerate sequential msg_id values and set a global flag in the stream_handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb_handler endpoint further discloses thumbnails from those same chats without any token validation. | ||||
| CVE-2026-53997 | 1 Netherman | 1 Portal Del Hermano (portaldelhermano.es) | 2026-10-13 | 7.4 High |
| Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password/create-access and POST /password/email endpoints, allowing unauthenticated attackers to take over any member account across all tenants by exploiting the lack of rate limiting and distinct error messages that act as oracles for each of the four identity-verification factors (DNI, date of birth, phone number, last four IBAN digits). Attackers can confirm the DNI via the oracle, brute-force the date of birth and IBAN digits, obtain the phone number through open-source intelligence, then submit an attacker-controlled email field so the password reset link is delivered to them, enabling full account takeover including profile data, full IBAN, and fiscal documents. | ||||
| CVE-2020-37279 | 1 Karuppiah7890 | 1 Easy-pdf-merge | 2026-10-13 | 8.1 High |
| easy-pdf-merge 0.1.0 through 0.2.6 contains an OS command injection vulnerability that allows attackers to execute commands by injecting shell metacharacters into source paths, destination path, or maxHeap option. Attackers can supply file names or options containing double quotes, semicolons, $() or backticks, which child_process.exec() runs through a shell with the Node.js process privileges. | ||||
| CVE-2020-37280 | 1 Pelioniot | 1 Cbor-sync | 2026-10-13 | 7.5 High |
| cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory. | ||||
| CVE-2021-48012 | 1 Gin-quin | 1 Fast-toml | 2026-10-13 | 8.2 High |
| fast-toml through 0.5.4 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying TOML containing __proto__, constructor or prototype key segments. Attackers can pass [__proto__] or [constructor.prototype] table headers or __proto__.x dotted keys to parse() to pollute all objects, causing denial of service or authorization bypass. | ||||
| CVE-2022-51020 | 2 Flower Project, Mher | 2 Flower, Flower | 2026-10-13 | 5.9 Medium |
| Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite. Attackers can lure authenticated users to malicious pages that POST to /api/worker/shutdown, /api/worker/pool/restart, or /api/task/revoke to shut down Celery workers, resize pools, and revoke tasks. | ||||
| CVE-2024-58389 | 1 Holoviz | 1 Panel | 2026-10-13 | 6.1 Medium |
| HoloViz Panel from 1.2.2 before 1.9.0 contains an open redirect vulnerability in panel/auth.py that allows remote attackers to redirect users by supplying an unvalidated next query parameter. BasicLoginHandler and PasswordLoginHandler store the parameter in a next_url cookie, so crafted login links send victims to attacker-controlled external sites after successful login. | ||||
| CVE-2026-109556 | 1 Tianma-if | 1 Edgeever | 2026-10-13 | 8 High |
| EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a sender check and spawns a caller-supplied input.path executable. Attackers with script execution in a renderer, such as via template-preview or drag-preview stored cross-site scripting, can call probeAcpAdapter to launch local executables with the user's privileges. | ||||
| CVE-2026-109557 | 1 Tianma-if | 1 Edgeever | 2026-10-13 | 8.7 High |
| EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles. Attackers can set malicious names via MCP create_notebook, rename_notebook or create_memo tools, running script on drag with access to the desktop bridge's session token. | ||||
| CVE-2026-109558 | 1 Tianma-if | 1 Edgeever | 2026-10-13 | 8.7 High |
| EdgeEver 1.6.0 through 1.112.0 contains a stored cross-site scripting vulnerability in TemplatesPane.tsx that renders template contentMarkdown with raw HTML via dangerouslySetInnerHTML without sanitization. Attackers can write templates containing HTML event handlers through an API or MCP token to run script on preview and access the privileged window.edgeeverDesktop bridge. | ||||
| CVE-2026-109559 | 1 Tianma-if | 1 Edgeever | 2026-10-13 | 8.7 High |
| EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels. | ||||
| CVE-2026-109562 | 1 Snapotter-hq | 1 Snapotter | 2026-10-13 | 5.4 Medium |
| SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers holding even a settings:read-scoped API key can stage arbitrary files outside storage quota, served unauthenticated via /api/v1/download, and feed crafted input to image and video decoders. | ||||
| CVE-2026-109563 | 1 Rdfjs | 1 N3.js | 2026-10-13 | 7.5 High |
| N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs. Attackers can supply untrusted Turtle or N3 input containing long runs of digits that do not end a number, blocking the Node.js event loop and causing denial of service. | ||||