VulnCheck

Latest CVEs · RSS

• CVE-2026-111723 2026-10-16 · CVSS 8.7
  LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1
• CVE-2026-111722 2026-10-16 · CVSS 8.6
  LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects bec
• CVE-2026-111721 2026-10-16 · CVSS 5.3
  Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGa
• CVE-2026-111720 2026-10-16 · CVSS 6.9
  fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server
• CVE-2026-111719 2026-10-16 · CVSS 8.2
  Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retriev
• CVE-2026-111718 2026-10-16 · CVSS 7.1
  AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api
• CVE-2026-111717 2026-10-16 · CVSS 5.3
  Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill v
• CVE-2026-111716 2026-10-16 · CVSS 5.3
  Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-
• CVE-2026-111715 2026-10-16 · CVSS 5.3
  Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadat
• CVE-2026-111714 2026-10-16 · CVSS 2.3
  tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped
• CVE-2026-111713 2026-10-16 · CVSS 5.1
  tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard
• CVE-2026-111712 2026-10-16 · CVSS 6.9
  Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handl
• CVE-2026-111711 2026-10-16 · CVSS 9.3
  Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-aut
• CVE-2026-111710 2026-10-16 · CVSS 8.7
  Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated at
• CVE-2026-111709 2026-10-16 · CVSS 5.3
  WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' t
• CVE-2026-111708 2026-10-16 · CVSS 9.3
  WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrat
• CVE-2026-111707 2026-10-16 · CVSS 6.9
  99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because q
• CVE-2026-111706 2026-10-16 · CVSS 8.7
  99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export al
• CVE-2026-111705 2026-10-16 · CVSS 5.3
  Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records
• CVE-2026-111704 2026-10-16 · CVSS 9.3
  LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because
• CVE-2026-111703 2026-10-16 · CVSS 5.3
  yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records
• CVE-2026-111702 2026-10-16 · CVSS 8.7
  ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowled
• CVE-2026-111701 2026-10-16 · CVSS 8.3
  OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucket objects because /s
• CVE-2026-111700 2026-10-16 · CVSS 7.1
  WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL through WHERE-clause text literals in the EQ
• CVE-2026-111699 2026-10-16 · CVSS 6.3
  Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw o