CVEs
Browse the synced catalog, newest first.
- CVE-2026-125376VanBlog through 0.54.0 Private Article Disclosure via Public Password EndpointMereithhh vanblog
- CVE-2026-125375MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlerszmister2016 MrDoc
- CVE-2026-125374Krayin CRM before 2.2.8 Broken Object Level Authorization via Lead Tag Attach/Detachkrayin laravel-crm
- CVE-2026-125373IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Viewsietf-tools datatracker
- CVE-2026-125372REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpointsgetrebuild rebuild
- CVE-2026-125371Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Matchtinyproxy
- CVE-2026-125370Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secretkubero-dev kubero
- CVE-2026-125369Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookupsfsinfuhh Bitpoll
- CVE-2026-125368OmniAgent Bash Approval Gate Bypass via find -execdir in Safe-Command AllowlistYeQing17-2026 OmniAgent
- CVE-2026-125367Pico through 4.1.2 SSRF in Feeds Service via run SSH Commandpicosh pico
- CVE-2026-125366Omnom through 0.9.0 SSRF via Add Feed /add_feed Routeasciimoo omnom
- CVE-2026-125365DollarDollar through 4.4 Missing Authorization in /add_expense Balance Tamperingharung1993 dollardollar
- CVE-2026-125364frab through 0.9.1 Privilege Escalation via conference_users_attributes in UsersControllerfrab
- CVE-2026-125363MikroDash before 0.8.79 SSRF via Personal Notification ChannelsSecOps-7 MikroDash
- CVE-2026-125362Seahub through 14.0.10 Predictable Share Link Passwords via Batch Endpointhaiwen seahub
- CVE-2026-125361Tencent BrowserSkill through 0.4.2 Missing Authentication in Local WebSocket TransportTencent BrowserSkill
- CVE-2026-125360Storyden through 1.26.16 Privilege Escalation via MANAGE_ROLES Role AssignmentSouthclaws storyden
- CVE-2026-125359Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Settingfancydirty mediary-scout
- CVE-2026-125358Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLinkrehan-remade universal-modder
- CVE-2026-125357Munin munin-httpd through 2.999.18 Path Traversal via Static File Handlermunin-monitoring munin
- CVE-2026-117477KUSANAGI provided by GMO Prime Strategy Co., Ltd.GMO Prime Strategy Co. KUSANAGI 7 Security Edition · GM… +13
- CVE-2026-125075SourceCodester Smart Attendance System with QR Code Scanner Admin Account Creation create_admin.php getMessage missing authenticationSourceCodester Smart Attendance System with QR Code Scanner
- CVE-2026-115934SQL injection leading to privilege escalationcraftcms/cms
- CVE-2026-125074SourceCodester Smart Attendance System with QR Code Scanner Password Reset reset_password.php password recoverySourceCodester Smart Attendance System with QR Code Scanner
- CVE-2026-125120Mongoose: sanitizeFilter not applied on countDocumentsAutomattic mongoose · mongoose
- CVE-2026-125119Mongoose: Connection-level sanitizeFilter not appliedAutomattic mongoose · mongoose
- CVE-2026-125118Mongoose: Prototype pollution via Schema.prototype.virtual()Automattic mongoose · mongoose
- CVE-2026-124035Unsafe reflection in Amazon Braket Schemas error mitigation validationamazon-braket-schemas
- CVE-2026-124034Path traversal in Amazon Braket SDK local hybrid job input data downloadAWS amazon-braket-sdk
- CVE-2026-125117Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of…Automattic mongoose · mongoose