Total
419308 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-121434 | 2026-11-03 | N/A | 5.4 MEDIUM | ||
| Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API commands, which do not verify whether a domain's certificate is Let's Encrypt-managed. Customers with API access can overwrite the managed certificate and private key with an attacker-chosen pair, which a REBUILD_VHOST task deploys to the webserver, breaking HTTPS and desynchronizing ACME automation. | |||||
| CVE-2026-121431 | 2026-11-03 | N/A | 5.3 MEDIUM | ||
| AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services. | |||||
| CVE-2026-121430 | 2026-11-03 | N/A | 5.4 MEDIUM | ||
| AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data. | |||||
| CVE-2026-121427 | 2026-11-03 | N/A | 7.5 HIGH | ||
| AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend. | |||||
| CVE-2026-121423 | 2026-11-03 | N/A | 6.5 MEDIUM | ||
| SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants. | |||||
| CVE-2026-121422 | 2026-11-03 | N/A | 4.1 MEDIUM | ||
| SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services. | |||||
| CVE-2026-121419 | 2026-11-03 | N/A | 8.1 HIGH | ||
| SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions. | |||||
| CVE-2026-121418 | 2026-11-03 | N/A | 4.3 MEDIUM | ||
| SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors. | |||||
| CVE-2026-121415 | 2026-11-03 | N/A | 3.7 LOW | ||
| Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields. | |||||
| CVE-2026-121414 | 2026-11-03 | N/A | 5.9 MEDIUM | ||
| Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process. | |||||
| CVE-2026-120831 | 2026-11-03 | N/A | 6.5 MEDIUM | ||
| A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host networking process, causing a denial of service. | |||||
| CVE-2026-107059 | 2026-11-03 | N/A | 7.5 HIGH | ||
| An issue in Nextcloud versionCode 30390190 allows attackers to force victim users to logout of their accounts and switch to an attacker controlled progile, bypassing authentication. | |||||
| CVE-2026-107053 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in foobnix Librera PDF Reader versionCode 7222 allows unauthorized attackers to arbitrarily write and truncate files in a shared storage space outside of the sandbox. | |||||
| CVE-2026-107048 | 2026-11-03 | N/A | 9.8 CRITICAL | ||
| An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to execute arbitrary code via supplying a crafted POST request. | |||||
| CVE-2026-107043 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's SMS-code-capture mechanism. | |||||
| CVE-2026-107038 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in Yet Another UPnP Controller versionCode 50200 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and control of application data. | |||||
| CVE-2026-107033 | 2026-11-03 | N/A | 6.5 MEDIUM | ||
| Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthorized attackers to arbitrarily read and modify another user's task database. | |||||
| CVE-2026-107027 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in lz233 Tarnhelm v1.8.2 (versionCode 20250630) allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting. | |||||
| CVE-2026-107021 | 2026-11-03 | N/A | 9.1 CRITICAL | ||
| Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database. | |||||
| CVE-2026-107016 | 2026-11-03 | N/A | 7.5 HIGH | ||
| Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts. | |||||