Export limit exceeded: 235339 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (235339 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75577 | 2026-11-13 | 7.2 High | ||
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command. | ||||
| CVE-2026-75578 | 2026-11-13 | 7.2 High | ||
| Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute(), so the nested quotes terminate the outer quote. Authenticated administrators can upload an .ovpn file whose remote host token contains a semicolon to execute arbitrary commands as root. | ||||
| CVE-2026-126264 | 1 B3log | 1 Siyuan | 2026-11-13 | 7.7 High |
| SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets. | ||||
| CVE-2026-126265 | 1 B3log | 1 Siyuan | 2026-11-13 | 7.4 High |
| SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session. | ||||
| CVE-2026-126266 | 1 B3log | 1 Siyuan | 2026-11-13 | 7.5 High |
| SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field. | ||||
| CVE-2026-126267 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process. | ||||
| CVE-2026-126268 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 5.3 Medium |
| NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter. | ||||
| CVE-2026-126269 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.7 High |
| NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims. | ||||
| CVE-2026-126270 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load. | ||||
| CVE-2026-126271 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.7 High |
| NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions. | ||||
| CVE-2026-126272 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory. | ||||
| CVE-2026-126273 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.1 High |
| NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control. | ||||
| CVE-2026-126274 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.7 High |
| NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage. | ||||
| CVE-2026-126275 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.1 High |
| NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments. | ||||
| CVE-2026-126276 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.3 Medium |
| NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret. | ||||
| CVE-2026-126277 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.5 High |
| NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process. | ||||
| CVE-2026-126278 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.5 High |
| NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out. | ||||
| CVE-2026-126279 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.3 Medium |
| NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's field reference that executes when victims open the field configuration, stealing the localStorage session token to call authenticated APIs as the victim. | ||||
| CVE-2026-126280 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.4 High |
| NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded. | ||||
| CVE-2026-126281 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation in integrations.service.ts that decrypts a source integration's connection credentials without checking its owner or private flag. Authenticated users with the Creator role can supply guessed or enumerated integration ids to copy other users' private database host, username, and password into an integration they own. | ||||