Export limit exceeded: 418615 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 16166 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16166 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-114553 | 1 Drupal | 1 Frontend Editing | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Frontend Editing allows Forceful Browsing. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3. | ||||
| CVE-2026-114543 | 1 Drupal | 1 Simple User Management | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0. | ||||
| CVE-2026-114540 | 1 Drupal | 1 Domain | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2. | ||||
| CVE-2026-114537 | 1 Drupal | 1 View Unpublished | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0. | ||||
| CVE-2026-114535 | 1 Drupal | 1 Swiper Formatter | 2026-10-30 | N/A |
| Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0. | ||||
| CVE-2026-114533 | 1 Drupal | 1 Ágora Transparency Theme | 2026-10-30 | N/A |
| Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3. | ||||
| CVE-2026-114530 | 1 Drupal | 1 Dopup | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Dopup allows Forceful Browsing. This issue affects Dopup versions: from 0.0.0 to 1.0.7. | ||||
| CVE-2026-107255 | 1 Drupal | 1 Restrict Route By Ip | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful Browsing. This issue affects Restrict route by IP versions: from 0.0.0 to 1.3.1, from 2.0.0 to 2.0.1. | ||||
| CVE-2026-107309 | 1 Drupal | 1 Easy Breadcrumb | 2026-10-30 | 3.7 Low |
| Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11. | ||||
| CVE-2026-107307 | 1 Drupal | 1 Smartlinker Ai | 2026-10-30 | 4.3 Medium |
| Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3. | ||||
| CVE-2026-107267 | 1 Drupal | 1 Dkan | 2026-10-30 | 5.3 Medium |
| Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5. | ||||
| CVE-2026-96389 | 1 Drupal | 1 Xray Audit | 2026-10-30 | 6.5 Medium |
| Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1. | ||||
| CVE-2026-107266 | 1 Drupal | 1 Views Share | 2026-10-30 | N/A |
| Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1. | ||||
| CVE-2026-107263 | 1 Drupal | 1 Gutenberg | 2026-10-30 | 5.4 Medium |
| Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7. | ||||
| CVE-2026-107258 | 1 Drupal | 1 Inline Entity Form Dialog | 2026-10-30 | 5.4 Medium |
| Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6. | ||||
| CVE-2026-107257 | 1 Drupal | 1 Actstream | 2026-10-30 | 6.5 Medium |
| Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. | ||||
| CVE-2026-107251 | 1 Drupal | 1 Entity Reference Manager (merge Entities) | 2026-10-30 | 6.5 Medium |
| Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing. This issue affects Entity Reference Manager (Merge entities) versions: from 0.0.0 to 1.0.3. | ||||
| CVE-2026-119653 | 1 Admpub | 1 Nging | 2026-10-30 | 4.3 Medium |
| Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manager permission can supply arbitrary paths in the query parameter to enumerate directories readable by the Nging process and confirm specific files exist. | ||||
| CVE-2026-119287 | 1 Zuke-build | 1 Zuke | 2026-10-30 | 8 High |
| Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for remote module descriptors. When zuke mcp --registry --allow-run reads a registry writable by another party and a run-capable caller invokes the affected tool, the registry writer can choose the program and arguments executed with the operator's environment and workspace access. The --allow-run and --protect name globs do not contain the issue because the descriptor supplies those names, and the optional destructive confirmation displays a description controlled by the same writer. The local default registry populated only through zuke register is not affected because that command writes module-form descriptors. This issue is fixed in version 1.51.0. | ||||
| CVE-2026-61826 | 1 Morpheus65535 | 1 Bazarr | 2026-10-30 | 10 Critical |
| Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review. | ||||