Export limit exceeded: 415500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415500 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415500 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-2270 | 2026-10-27 | 5.9 Medium | ||
| A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full control over the resulting pod’s metadata and specification, including namespace selection. Note that the cross-namespace pod will be immediately deleted by the garbage collector unless the attacker is able to construct a valid StatefulSet OwnerReference. This would require referencing the UID of an existing StatefulSet in the victim’s namespace. | ||||
| CVE-2026-116828 | 1 Yeswiki | 1 Yeswiki | 2026-10-27 | 4.9 Medium |
| YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the database including user password hashes. | ||||
| CVE-2026-116827 | 1 Yeswiki | 1 Yeswiki | 2026-10-27 | 6.8 Medium |
| YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields. Attackers can bypass the extension check with a query-string suffix or redirects to fetch cloud metadata credentials, internal services, or local files via file://, with responses stored in the web-accessible files/ directory. | ||||
| CVE-2026-116825 | 1 Yeswiki | 1 Yeswiki | 2026-10-27 | 6.5 Medium |
| YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions. | ||||
| CVE-2026-116824 | 1 Yeswiki | 1 Yeswiki | 2026-10-27 | 6.1 Medium |
| YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metacharacters that renders unescaped, executing JavaScript for any referrer-sites page visitor to perform same-origin authenticated actions. | ||||
| CVE-2026-116823 | 1 Yeswiki | 1 Yeswiki | 2026-10-27 | 6.1 Medium |
| YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue() falls back to unsanitized $_REQUEST values rendered via Twig |raw templates, performing same-origin authenticated actions in victims' sessions. | ||||
| CVE-2026-116821 | 1 Yeswiki | 1 Yeswiki | 2026-10-27 | 6.5 Medium |
| YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API. | ||||
| CVE-2026-116820 | 1 Yeswiki | 1 Yeswiki | 2026-10-27 | 5.3 Medium |
| YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain table names, JSON storage paths, ACL filter logic, and collation, aiding targeted SQL injection. | ||||
| CVE-2026-116819 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 8.5 High |
| OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems. | ||||
| CVE-2026-116817 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 6.5 Medium |
| OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health. | ||||
| CVE-2026-116815 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 4.3 Medium |
| OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events[].name values to the chart.sankey procedure, causing ClickHouse parse errors that disable the project's Sankey chart endpoint. | ||||
| CVE-2026-116814 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 6.5 Medium |
| OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset tokens logged when SMTP_HOST and RESEND_API_KEY are unset. | ||||
| CVE-2026-116812 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 6.5 Medium |
| OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data. | ||||
| CVE-2026-116811 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 8.8 High |
| OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process. | ||||
| CVE-2026-116810 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 5.3 Medium |
| OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-based project IDs to dump cross-tenant annotation titles, descriptions, and dates such as release notes and deploy markers. | ||||
| CVE-2026-116808 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 7.2 High |
| OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions. | ||||
| CVE-2026-116807 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 6.5 Medium |
| OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to bypass the project_id WHERE clause and read events from all projects. | ||||
| CVE-2026-116806 | 1 Openpanel | 1 Openpanel | 2026-10-27 | 5.4 Medium |
| OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers can repeatedly call the endpoint with a member session to obtain plaintext secrets, inject fake analytics events, poison business metrics, and consume the organization's usage budget. | ||||
| CVE-2026-116800 | 1 Wwbn | 1 Avideo | 2026-10-27 | 6.2 Medium |
| WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....// to bypass single-pass removal in setLanguage(), executing existing server-side PHP files in the application context. | ||||
| CVE-2026-116603 | 1 Sourcecodester | 1 Online Food Ordering System | 2026-10-27 | 4.7 Medium |
| A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used. | ||||