Export limit exceeded: 12676 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (12676 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-72823 | 1 Getgrav | 1 Grav | 2026-08-14 | 5.4 Medium |
| The Grav API plugin (getgrav/grav-plugin-api) before 1.0.13 contains an API-key scope cap bypass in DemoController. Its private requireSuper() method checks isSuperAdmin() and returns early before invoking requirePermission(), so the api_key_scopes cap (enforced only in requirePermission()) is skipped. As a result, any scoped API key minted on a super account can bypass its scope restrictions when calling the baseline() and reset() operations (e.g. POST /api/v1/demo/reset), allowing it to capture the demo baseline or force a demo reset. Impact is bounded to demo-engine control and is conditional on demo mode being configured with writable resources. | ||||
| CVE-2026-53786 | 1 Rsync Project | 1 Rsync | 2026-08-14 | 6.5 Medium |
| rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude. | ||||
| CVE-2026-70463 | 1 Rsync Project | 1 Rsync | 2026-08-14 | 8.1 High |
| rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing. | ||||
| CVE-2026-70452 | 1 Rsync Project | 1 Rsync | 2026-08-14 | 7.4 High |
| rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees. | ||||
| CVE-2026-55987 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | N/A |
| OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | ||||
| CVE-2026-57886 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | N/A |
| Cross-repository issue/comment attachment re-linking can expose private attachment content | ||||
| CVE-2026-58416 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.1 High |
| Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) | ||||
| CVE-2026-28159 | 2 Aonetheme, Wordpress | 2 Service Finder Booking, Wordpress | 2026-08-14 | 6.5 Medium |
| Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions. | ||||
| CVE-2026-28186 | 2 Themefic, Wordpress | 2 Travelfic Toolkit, Wordpress | 2026-08-14 | 8.1 High |
| Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. | ||||
| CVE-2026-61978 | 2 Webhosting4ugr, Wordpress | 2 Secure Card Gateway For Epay Paycenter (piraeus Bank), Wordpress | 2026-08-14 | 6.5 Medium |
| Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions. | ||||
| CVE-2026-66431 | 2 Woompaloompa, Wordpress | 2 Bitcoin Lightning Payment Gateway For Woocommerce (via Clink), Wordpress | 2026-08-14 | 7.5 High |
| Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions. | ||||
| CVE-2026-66454 | 2 Maruti Mohanty, Wordpress | 2 Wp Social Avatar, Wordpress | 2026-08-14 | 6.5 Medium |
| Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions. | ||||
| CVE-2026-66455 | 2 Rockiger, Wordpress | 2 Reactpress, Wordpress | 2026-08-14 | 6 Medium |
| Subscriber Broken Access Control in ReactPress <= 3.4.0 versions. | ||||
| CVE-2026-66459 | 2 Space Codes, Wordpress | 2 Ai For Seo, Wordpress | 2026-08-14 | 6.5 Medium |
| Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions. | ||||
| CVE-2026-66464 | 2 Toast Plugins, Wordpress | 2 Internal Link Optimiser, Wordpress | 2026-08-14 | 6.5 Medium |
| Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions. | ||||
| CVE-2026-66466 | 2 Wedevs, Wordpress | 2 Storegrowth: Smart Sales Booster For Woocommerce | Bogo, Upsells, Direct Checkout, Quick View, Side Cart, Wordpress | 2026-08-14 | 7.5 High |
| Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions. | ||||
| CVE-2026-66469 | 2 Afonso Matos, Wordpress | 2 Arvow Ai Seo Writer, Wordpress | 2026-08-14 | 7.5 High |
| Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. | ||||
| CVE-2026-73656 | 1 Triggerdotdev | 1 Trigger.dev | 2026-08-14 | 9.9 Critical |
| Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createDeploymentBackgroundWorkerV4.server.ts, where workerDeployment.findFirst() selects a deployment by friendlyId without an environmentId predicate. A caller with a valid API key for one project can submit another project's deployment identifier, link an attacker-owned background worker to the victim deployment, and move the victim deployment from BUILDING to DEPLOYING. This issue is fixed in version 4.5.6. | ||||
| CVE-2026-73658 | 1 Triggerdotdev | 1 Trigger.dev | 2026-08-14 | 8.2 High |
| Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet keys to URL.pathname, while apps/webapp/app/routes/api.v1.packets.$.ts accepts params["*"] without rejecting dot segments and uses findResource: async () => 1 without per-resource ownership validation. WHATWG path normalization collapses .. segments before signing, allowing a caller with a valid environment API key to obtain presigned URLs for another tenant's object-store keys and read or overwrite task payloads. This issue is fixed in version 4.5.0-rc.5. | ||||
| CVE-2026-19786 | 2 Francoisjacquet, Rosariosis | 2 Rosariosis, Rosariosis | 2026-08-14 | 4.3 Medium |
| A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component. | ||||