CVEs
Browse the synced catalog, newest first.
- CVE-2026-71548SuiteCRM: Authenticated SQL Injection in AOR_Reports `parameter_value` (value_type=Field) allows any low-privileged user to read the full…SuiteCRM
- CVE-2026-71550SuiteCRM: LFI to RCE via AOW_WorkFlowSuiteCRM
- CVE-2026-69134SuiteCRM: SQL Injection via REST API securexss() Bypass in Relationship ManagementSuiteCRM
- CVE-2026-69141SuiteCRM: SQL injection via search param in modules/Cases/controller.phpSuiteCRM
- CVE-2026-69142SuiteCRM: Authenticated SQL Injection in map_markers distance ParameterSuiteCRM
- CVE-2026-69140SuiteCRM: SQL injection via get_latest_for_id param in GetLatestRevision.phpSuiteCRM
- CVE-2026-69145SuiteCRM: AOR Reports aor_fields.field SQL InjectionSuiteCRM
- CVE-2026-69136SuiteCRM: Authenticated SQL Injection In handleAttachments functionSuiteCRM
- CVE-2026-69135SuiteCRM: Authenticated SQL Injection In Project ModuleSuiteCRM
- CVE-2026-69144SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.phpSuiteCRM
- CVE-2026-69137SuiteCRM: Authenticated SSRF in CalendarAccount testConnection Allows Internal Network Access and Response DisclosureSuiteCRM
- CVE-2026-61648SuiteCRM: SQL injection via parameter_value[0] param in AOR_Report.phpSuiteCRM
- CVE-2026-61650SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorizationSuiteCRM
- CVE-2026-61653SuiteCRM: SQL injection via id param in modules/Campaigns/PopupCampaignRoi.phpSuiteCRM
- CVE-2026-63213SuiteCRM: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SuiteCRMSuiteCRM
- CVE-2026-123208noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Serverlibnoname noname
- CVE-2026-123207LibreTV before v2.21.2 SSRF Protection Bypass via DNS RebindingLibreSpark LibreTV
- CVE-2026-123206EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:keyaozorae EdgeChat
- CVE-2026-123205accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsqlaccel-ppp
- CVE-2026-123204Posta before v0.18.0 SSRF via Webhook URLgoposta posta
- CVE-2026-123203NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokensneuronsimulator NEURON
- CVE-2026-123202libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML namebakulf libnxml
- CVE-2026-123201buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle APIjarun buku
- CVE-2026-123200VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length indexVRPN
- CVE-2026-123199eBook-speaker through 6.2.0 Stack-based Buffer Overflow via element name attributebook-readers eBook-speaker
- CVE-2026-123198LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>LMFDB
- CVE-2026-123197WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /fileswppconnect-server
- CVE-2026-123196Authorizer before 2.4.2 Password Reset Poisoning via x-authorizer-url gRPC metadataauthorizerdev authorizer
- CVE-2026-61649SuiteCRM: isSelfRequest() bypass via substring match allows SSRF to internal servicesSuiteCRM
- CVE-2026-63215SuiteCRM: Time-Based Blind SQL Injection via REST APISuiteCRM