Export limit exceeded: 237703 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 237703 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (237703 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-129120 | 1 Openkermit | 1 C-kermit | 2026-11-14 | 5.3 Medium |
| C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution. | ||||
| CVE-2026-129119 | 1 Openkermit | 1 C-kermit | 2026-11-14 | 6.5 Medium |
| C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files. | ||||
| CVE-2026-129118 | 1 Openkermit | 1 C-kermit | 2026-11-14 | 6.8 Medium |
| C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections. | ||||
| CVE-2026-129117 | 1 Openkermit | 1 C-kermit | 2026-11-14 | 6.8 Medium |
| C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data. | ||||
| CVE-2026-129116 | 1 Openkermit | 1 C-kermit | 2026-11-14 | 7.5 High |
| C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account with any password, gaining that account's shell access. | ||||
| CVE-2026-126091 | 1 Identalsoft | 1 Identalsoft | 2026-11-14 | 7.5 High |
| Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3. | ||||
| CVE-2026-124041 | 1 Catalis | 1 Webpro | 2026-11-14 | 6.5 Medium |
| Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database, enabling exfiltration of sensitive property and taxpayer information. | ||||
| CVE-2026-123965 | 1 Jet Admin | 1 Jet Admin Cloud Platform | 2026-11-14 | 9.9 Critical |
| A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026. | ||||
| CVE-2026-129171 | 1 Likaia | 1 Nginxpulse | 2026-11-14 | 9.8 Critical |
| NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions. | ||||
| CVE-2026-129169 | 1 Jinnrry | 1 Pmail | 2026-11-14 | 5.4 Medium |
| PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover. | ||||
| CVE-2026-129168 | 1 Jinnrry | 1 Pmail | 2026-11-14 | 6.1 Medium |
| PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's. | ||||
| CVE-2026-129167 | 1 Seafile | 1 Seadoc | 2026-11-14 | 8.1 High |
| Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability that allows unauthenticated attackers holding a public share token to execute code. Attackers supply an absolute filename to /api/v1/confluence-to-wiki/ to extract a ZIP from download_url into the Python library path, then trigger the module's import via a file-convert request. | ||||
| CVE-2026-129164 | 1 Dromara | 1 Free-fs | 2026-11-14 | 5.9 Medium |
| Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code-protected shares because share codes are enforced only client-side. Attackers knowing a share ID can call the share items and download endpoints to list and download files without the code, even on preview-only shares. | ||||
| CVE-2026-129163 | 1 Dromara | 1 Free-fs | 2026-11-14 | 5.4 Medium |
| Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account. | ||||
| CVE-2026-129162 | 1 Dromara | 1 Free-fs | 2026-11-14 | 5.9 Medium |
| Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview that allows unauthenticated attackers to download stored files. Attackers who obtain a file ID from share listings or preview links can request /api/file/stream/preview/{fileId} to download any user's or workspace's files. | ||||
| CVE-2026-129161 | 1 Dromara | 1 Free-fs | 2026-11-14 | 7.4 High |
| Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code for a known email and submit unlimited guesses during its 300-second lifetime to set a chosen password and take over the account. | ||||
| CVE-2026-129160 | 1 Dromara | 1 Free-fs | 2026-11-14 | 6.5 Medium |
| free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the orderBy parameter of the /apis/share/pages endpoint verbatim into the ORDER BY clause via MyBatis-Flex without a column whitelist. Authenticated users can supply CASE WHEN subquery expressions that use share ordering as a boolean oracle to read arbitrary database contents, such as share codes. | ||||
| CVE-2026-129158 | 1 Nageoffer | 1 Ragent | 2026-11-14 | 5.4 Medium |
| ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover. | ||||
| CVE-2026-129157 | 1 Nageoffer | 1 Ragent | 2026-11-14 | 4.3 Medium |
| ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-in user to view all users' RAG traces. Attackers can page through /rag/traces/runs and related node endpoints to read other users' usernames, user ids, conversation ids, questions, and per-node execution details. | ||||
| CVE-2026-128071 | 1 Nuxt | 3 Nuxt, Nuxt/nitro-server, Vite-server | 2026-11-14 | 6.5 Medium |
| Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server from 3.20.0 until 4.6.4, and @nuxt/vite-server from 4.6.0 until 4.6.4, routeRules matching leaves an encoded slash (%2F) in the request path while a catch-all page such as app/pages/[...slug].vue or a custom multi-segment page route decodes it into a route parameter. The getRouteRules result is therefore incomplete, and an unauthenticated request can render the page without the redirect, headers, proxy, SSR, noScripts, appMiddleware, or appLayout rules configured for the decoded path. Protected content is resolved only when the page interprets the decoded parameter accordingly: a custom multi-segment parameter can contain the decoded path, while a repeatable catch-all must join the slash-containing array element; route.path remains encoded and does not resolve that resource. Static pages, single-segment parameters, server/api handlers, and server/routes handlers are not affected because they do not have the same encoded-path mismatch. This issue is fixed in version 4.6.4. | ||||