Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,983

Export CSV
CVE-2026-70406

Gitea private comparison disclosure with public-only tokens

Gitea's shared comparison helper omits the token repository-access check used when updating pull requests. A public-only token with read:repository scope can route a comparison or pull request creation through a public base repository and retrieve commit history and diffs from a private head repository accessible to the token owner. This bypasses the token's public-only restriction; it does not remove the account's underlying repository permission checks.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-74034

Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command

Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the agent channel to read arbitrary files as root, exfiltrating /etc/shadow and client.keys.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Wazuh
Products
Wazuh Wazuh-manager
CVE-2026-75505

EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Espocrm
Products
Espocrm
CVE-2026-70400

Gitea private migration creation with public-only tokens

Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository. A delegated token intended to operate only on public resources can create a private repository and migration task under the authorizing account or an organization where that user has the necessary permissions. The ordinary private repository-creation route rejects the same token, but the migration path omits that restriction.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-66853

Gitea restricted-user organization metadata disclosure

Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced by the single-organization endpoint. A restricted user can list a known user's public organization memberships and retrieve limited organizations' names, descriptions, and avatars. This exposes organization metadata that should be hidden from the requesting account.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-60010

Gitea organization team policy bypass through repository API

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-61843

FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. An unauthenticated visitor with a valid share token and any configured share password can upload a file with the same name as an existing file and silently replace its content while the original uploader metadata remains. The same replacement gap affects ordinary authenticated uploads through /api/upload/upload.php and authenticated upload-only users who lack edit authority over the existing file. This issue is fixed in version 3.18.0.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Error311
Products
Filerise
CVE-2026-55414

NL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)

NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjectenApiUrl and deprecated getFormDefinitionById GraphQL resolvers are reachable without CommonGroundAuthentication and forward a caller-influenced URL through ObjectenApiService.getObjectByUrl to ObjectsApiClient.getObjectByUrl, which attaches the privileged Objecten-API token. The host-equality check restricts requests to the configured Objecten-API host but does not constrain the scheme, port, or path, allowing an unauthenticated caller to induce a token-bearing request to a chosen endpoint on that host. Standard deployments are not exposed to cross-host SSRF, token capture requires attacker-controlled routing on the configured host, and typed deserialization limits returned data to objects shaped like form definitions. The 3.0 release line is fixed in version 3.0.4. The advisory does not identify a fixed 3.1 release.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Nl-portal
Products
Nl-portal-backend-libraries
CVE-2026-46694

EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the note identifier is known. Stream list responses correctly hide notes whose isInternal field is true, but the direct single-Note access check does not enforce that restriction, exposing internal agent content. This issue is fixed in version 9.3.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Espocrm
Products
Espocrm
CVE-2026-46708

EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Espocrm
Products
Espocrm
CVE-2026-46691

EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users

EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an attachment identifier for a CSV containing rows from that import. The endpoint performs a scope-level check but omits the entity-level ownership check enforced by the Import AccessChecker and sibling Import endpoints. This issue is fixed in version 9.3.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Espocrm
Products
Espocrm
CVE-2026-18659

Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jetty
Products
Jetty
CVE-2026-111606

Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft attacker-controlled unverified social ids onto a victim person, then use login or password recovery to take over the victim account.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Hcengineering
Products
Huly Platform
CVE-2026-111349

Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL

Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Puemos
Products
Craftplan
CVE-2026-111235

OpenNMS REST authorization bypass via non-canonical HTTP method

An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
The Opennms Group
Products
Horizon Meridian
CVE-2026-111277

NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the order_id parameter, which matches guest orders stored with customer_id 0, to disclose guest names, addresses, telephone numbers, emails, purchased items, and totals.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Nivocart
Products
Nivocart