Export limit exceeded: 425866 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,866

Export CSV
CVE-2026-109617

Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks during document creation. Authenticated low-privileged users can send requests to these endpoints to create documents against records beyond their permitted role, bypassing role-based permission restrictions.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-109612

Frappe ERPNext before 15.120.0 Stored XSS via Report View

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the session of any user who later opens the report.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-109604

ERPNext before 15.112.0 Stored XSS via Tool View Record Names

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the session of any user who later opens that tool.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Erpnext
CVE-2026-109599

Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification

Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-109326

Grav before 2.1.7 Information Disclosure via Nested .git Directories

Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav
CVE-2026-109321

Grav Login OAuth Plugin before 1.4.3 Predictable Local Credentials Authentication Bypass

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav-plugin-login-oauth
CVE-2026-109186

jshERP through 3.6 Mass Assignment via PUT /user/update

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Jishenghua
Products
Jsherp
CVE-2026-109181

jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list

jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills by adding a purchaseStatus value. Attackers can include purchaseStatus=0 in the search JSON on GET /depotHead/list, causing DepotHeadService.select to drop the creator filter and expose all tenant purchase, sales and inventory bills.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jishenghua
Products
Jsherp
CVE-2026-108950

Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes

Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate sequential file GUIDs to retrieve friends-only album photos and other stored files without any access check.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Opensource-socialnetwork
Products
Open Source Social Network
CVE-2026-108891

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary userId values to retrieve real names, usernames, emails, phone numbers, birthdays, employee numbers, department paths and posts.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot
CVE-2026-108884

JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint

JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete message templates. Low-privileged attackers can obtain template ids from the unguarded list endpoint and delete shipped notification templates, causing system notices and workflow reminders to fail.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot
CVE-2026-108879

JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter

JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId, username, and variable name to retrieve stored chat memory values from Redis.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg-boot Jeecg Boot
CVE-2026-108874

JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson

JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department id, and status values to make any user a department head, widening department-scoped views, or demote existing heads.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot Jeecgboot
CVE-2025-71430

Frappe before 15.91.1 Stored XSS via Leaderboard User Names

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2023-54410

Frappe before 13.22.0 Improper Authorization via Document Rename

Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper authorization.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Frappe
Products
Frappe
CVE-2026-74043

Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Wazuh
Products
Wazuh Wazuh-manager
CVE-2026-85812

Windows Bind Filter Driver Information Disclosure Vulnerability

Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 21h2 Windows 10 21h2 Windows 10 22h2 and 14 more