[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-15261 | 21 Oct 2026 | CVSS 5.3 | Unknown TI WooCommerce WishlistThe TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not enforce the same owner-only access control on its REST API that it applies on the… | |
| CVE-2026-107788 | 21 Oct 2026 | CVSS 4.3 | Unknown SmartyParcelThe SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any… | |
| CVE-2026-107789 | 21 Oct 2026 | CVSS 5.3 | Unknown SmartyParcelThe SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when serving shipping label downloads, allowing unauthenticated… | |
| CVE-2026-107790 | 21 Oct 2026 | CVSS 6.8 | Unknown HireZootThe HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and… | |
| CVE-2026-108073 | 21 Oct 2026 | CVSS 5.3 | Unknown SureCartThe SureCart WordPress plugin before 4.9.5 does not restrict which related objects an anonymous visitor may include when reading a single upsell… | |
| CVE-2026-109147 | 21 Oct 2026 | CVSS 7.1 | Unknown WP Booking SystemThe WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page… | |
| CVE-2026-109926 | 21 Oct 2026 | CVSS 4.3 | Unknown Productive CommerceThe Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that… | |
| CVE-2026-110514 | 21 Oct 2026 | CVSS 4.9 | Unknown WPZOOM Portfolio LiteThe WPZOOM Portfolio Lite WordPress plugin before 1.4.34 does not check that a user is allowed to edit a post before changing its type and order… | |
| CVE-2026-110523 | 21 Oct 2026 | CVSS 8.1 | Unknown WP User ManagerThe WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is… | |
| CVE-2026-110651 | 21 Oct 2026 | CVSS 6.8 | Unknown Swift Performance LiteThe Swift Performance Lite WordPress plugin before 2.3.7.4 does not properly sanitize and escape a value before using it in a SQL statement, which… | |
| CVE-2026-105262 | 21 Oct 2026 | CVSS 8.0 | Unknown Falang multilanguage for WordPressThe Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid… | |
| CVE-2026-105992 | 21 Oct 2026 | CVSS 5.3 | Unknown Ettrick Escape Room BookingThe Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking… | |
| CVE-2026-105996 | 21 Oct 2026 | CVSS 4.8 | Unknown Booking PackageThe Booking Package WordPress plugin before 1.7.31 does not generate booking cancellation tokens using a secure source of randomness, deriving them… | |
| CVE-2026-105998 | 21 Oct 2026 | CVSS 5.3 | Unknown Booking PackageThe Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription… | |
| CVE-2026-105999 | 21 Oct 2026 | CVSS 5.3 | Unknown Booking PackageThe Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning calendar-account configuration in a… | |
| CVE-2026-106932 | 21 Oct 2026 | CVSS 6.5 | Unknown MoloniThe Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on… | |
| CVE-2026-107127 | 21 Oct 2026 | CVSS 7.5 | Unknown Uncanny Toolkit for LearnDashThe Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated… | |
| CVE-2026-107128 | 21 Oct 2026 | CVSS 5.0 | Unknown Uncanny Toolkit for LearnDashThe Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts… | |
| CVE-2026-107237 | 21 Oct 2026 | CVSS 8.2 | Unknown Backup and Staging by WP Time CapsuleThe Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a… | |
| CVE-2026-107506 | 21 Oct 2026 | CVSS 7.5 | Unknown Simple BannerThe Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to… | |
| CVE-2026-102499 | 21 Oct 2026 | CVSS 7.7 | Unknown Modern Events Calendar LiteThe Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and escape a… | |
| CVE-2026-103302 | 21 Oct 2026 | CVSS 5.3 | Unknown Payment Gateway for IdramThe Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the merchant… | |
| CVE-2026-105257 | 21 Oct 2026 | CVSS 2.7 | Unknown Appointment Booking PluginThe Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before… | |
| CVE-2026-100145 | 21 Oct 2026 | CVSS 6.5 | Unknown Synchrony FinancingThe Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce… | |
| CVE-2026-82819 | 21 Oct 2026 | CVSS 7.1 | Cerberus FTP ServerA vulnerability in Cerberus FTP Server allows an authenticated remote attacker to perform UNC path injection via a manipulated parameter. By… | |
| CVE-2026-92823 | 21 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that… | |
| CVE-2026-92824 | 21 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its… | |
| CVE-2026-92822 | 21 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping… | |
| CVE-2026-114040 | 21 Oct 2026 | CVSS 3.5 | DT42 BerryNetA security vulnerability has been detected in DT42 BerryNet up to 3.10.2. The affected element is the function DLModelManager.get_model_meta of the… | |
| CVE-2026-114039 | 21 Oct 2026 | CVSS 6.3 | projectworlds Advanced Library Management SystemA weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file… | |
| CVE-2026-113744 | 21 Oct 2026 | CVSS 10.0 | Tenda AC19A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file… | |
| CVE-2026-82814 | 21 Oct 2026 | CVSS 8.8 | smub Duplicator – Backups & Migration Plugin – Cloud Backups, Scheduled Backups, & MoreThe Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to, and including, 1.5.17 and… | |
| CVE-2026-113743 | 21 Oct 2026 | CVSS 6.3 | Tenstorrent tt-metalA weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the function load_hf_state_dict_filtered of the file… | |
| CVE-2026-114117 | 21 Oct 2026 | CVSS 5.9 | vyperlang vyperVyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer… | |
| CVE-2026-114118 | 21 Oct 2026 | CVSS 4.8 | vyperlang vyperVyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that… | |
| CVE-2026-114119 | 21 Oct 2026 | CVSS 9.8 | Best Practice Software Bp PremierBest Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all… | |
| CVE-2026-114197 | 21 Oct 2026 | CVSS 8.7 | Mandiant FLARE capaDeserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv… | |
| CVE-2026-114198 | 21 Oct 2026 | CVSS 8.7 | Mandiant FLARE flossDeserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv… | |
| CVE-2026-114110 | 21 Oct 2026 | CVSS 5.3 | astral-sh uvAstral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative… | |
| CVE-2026-114111 | 21 Oct 2026 | CVSS 8.9 | lovell sharpsharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-specific… | |
| CVE-2026-114112 | 21 Oct 2026 | CVSS 8.9 | lovell sharpSharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based Linux by… | |
| CVE-2026-114113 | 21 Oct 2026 | CVSS 8.4 | lovell sharpSharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591… | |
| CVE-2026-114114 | 21 Oct 2026 | CVSS 5.3 | vyperlang vyperVyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in… | |
| CVE-2026-114115 | 21 Oct 2026 | CVSS 3.7 | vyperlang vyperVyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using… | |
| CVE-2026-114116 | 21 Oct 2026 | CVSS 5.3 | vyperlang vyperVyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which treats characters like form feed… | |
| CVE-2026-114103 | 21 Oct 2026 | CVSS 5.3 | cthackers adm-zipadm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard by targeting the asynchronous… | |
| CVE-2026-114104 | 21 Oct 2026 | CVSS 5.9 | cthackers adm-zipadm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying ZIP… | |
| CVE-2026-114105 | 21 Oct 2026 | CVSS 6.2 | cthackers adm-zipAdm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid, setgid, or sticky bits on… | |
| CVE-2026-114106 | 21 Oct 2026 | CVSS 7.5 | HKUDS Vibe-TradingHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files… | |
| CVE-2026-114107 | 21 Oct 2026 | CVSS 8.8 | HKUDS Vibe-TradingHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands… | |
| CVE-2026-114108 | 21 Oct 2026 | CVSS 9.8 | HKUDS Vibe-TradingHKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the… | |
| CVE-2026-114109 | 21 Oct 2026 | CVSS 8.8 | astral-sh uvuv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted… | |
| CVE-2026-114097 | 21 Oct 2026 | CVSS 7.8 | jelmer dulwichDulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files… | |
| CVE-2026-114098 | 21 Oct 2026 | CVSS 7.8 | jelmer dulwichDulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the… | |
| CVE-2026-114099 | 21 Oct 2026 | CVSS 5.8 | corazawaf corazaCoraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST names without escaping literal… | |
| CVE-2026-114100 | 21 Oct 2026 | CVSS 5.8 | corazawaf corazaCoraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection compares the entire Content-Type… | |
| CVE-2026-114101 | 21 Oct 2026 | CVSS 4.0 | corazawaf corazaCoraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987 filename* parameters whose… | |
| CVE-2026-114102 | 21 Oct 2026 | CVSS 7.5 | cthackers adm-zipadm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a malformed… | |
| CVE-2026-114091 | 21 Oct 2026 | CVSS 5.3 | triggerdotdev trigger.devTrigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping the lookup to the caller's… | |
| CVE-2026-114092 | 21 Oct 2026 | CVSS 6.5 | triggerdotdev trigger.devTrigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route… | |
| CVE-2026-114093 | 21 Oct 2026 | CVSS 4.3 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out authenticated users by sending a… | |
| CVE-2026-114094 | 21 Oct 2026 | CVSS 8.8 | jelmer dulwichDulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attackers can… | |
| CVE-2026-114095 | 21 Oct 2026 | CVSS 6.5 | jelmer dulwichDulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause infinite recursion via… | |
| CVE-2026-114096 | 21 Oct 2026 | CVSS 7.8 | jelmer dulwichDulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to write… | |
| CVE-2026-114085 | 21 Oct 2026 | CVSS 7.9 | triggerdotdev trigger.devTrigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows workloads to manipulate runs… | |
| CVE-2026-114086 | 21 Oct 2026 | CVSS 5.3 | triggerdotdev trigger.devTrigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated attackers… | |
| CVE-2026-114087 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication… | |
| CVE-2026-114088 | 21 Oct 2026 | CVSS 6.5 | triggerdotdev trigger.devTrigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated… | |
| CVE-2026-114089 | 21 Oct 2026 | CVSS 8.8 | triggerdotdev trigger.devTrigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading… | |
| CVE-2026-114090 | 21 Oct 2026 | CVSS 7.1 | trigger.dev cli-v3Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network… | |
| CVE-2026-114078 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that allows… | |
| CVE-2026-114079 | 21 Oct 2026 | CVSS 5.4 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel other… | |
| CVE-2026-114080 | 21 Oct 2026 | CVSS 5.0 | triggerdotdev trigger.devTrigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project members to make the server send… | |
| CVE-2026-114081 | 21 Oct 2026 | CVSS 7.7 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into generated… | |
| CVE-2026-114082 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain… | |
| CVE-2026-114083 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated… | |
| CVE-2026-114084 | 21 Oct 2026 | CVSS 7.7 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags query… | |
| CVE-2026-114072 | 21 Oct 2026 | CVSS 4.3 | triggerdotdev trigger.devThe Trigger.dev webapp before 4.5.12 contains a cross-site request forgery vulnerability in its organization-level Slack OAuth flow, which uses the… | |
| CVE-2026-114073 | 21 Oct 2026 | CVSS 5.5 | triggerdotdev trigger.devTrigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret values in debug deployment… | |
| CVE-2026-114074 | 21 Oct 2026 | CVSS 5.4 | triggerdotdev trigger.devTrigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook SSRF… | |
| CVE-2026-114075 | 21 Oct 2026 | CVSS 5.4 | triggerdotdev trigger.devTrigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted user-actor tokens to create… | |
| CVE-2026-114076 | 21 Oct 2026 | CVSS 5.4 | triggerdotdev trigger.devTrigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp server send… | |
| CVE-2026-114077 | 21 Oct 2026 | CVSS 7.1 | triggerdotdev trigger.devTrigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that resolves a WorkerDeployment by… | |
| CVE-2026-114066 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block runs they… | |
| CVE-2026-114067 | 21 Oct 2026 | CVSS 6.5 | triggerdotdev trigger.devTrigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public session… | |
| CVE-2026-114068 | 21 Oct 2026 | CVSS 8.3 | triggerdotdev trigger.devTrigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attackers to… | |
| CVE-2026-114069 | 21 Oct 2026 | CVSS 8.1 | triggerdotdev trigger.devTrigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which returns the… | |
| CVE-2026-114070 | 21 Oct 2026 | CVSS 3.5 | triggerdotdev trigger.devTrigger.dev 4.5.0 before 4.6.0 contains an information disclosure vulnerability in the Dashboard Agent input proxy that stores a delegated user-actor… | |
| CVE-2026-114071 | 21 Oct 2026 | CVSS 3.1 | triggerdotdev trigger.devTrigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's… | |
| CVE-2026-114060 | 21 Oct 2026 | CVSS 4.7 | sveltejs kitSvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths… | |
| CVE-2026-114061 | 21 Oct 2026 | CVSS 4.7 | sveltejs kitSvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set… | |
| CVE-2026-114062 | 21 Oct 2026 | CVSS 5.3 | sveltejs kitSvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because… | |
| CVE-2026-114063 | 21 Oct 2026 | CVSS 7.5 | sveltejs kitSvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows… | |
| CVE-2026-114064 | 21 Oct 2026 | CVSS 5.5 | grokability snipe-itSnipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to probe… | |
| CVE-2026-114065 | 21 Oct 2026 | CVSS 6.5 | triggerdotdev trigger.devTrigger.dev before 4.7.3 contains a tenant filtering bypass vulnerability that allows authenticated users to read other tenants' data by using… | |
| CVE-2026-114053 | 21 Oct 2026 | CVSS 8.1 | vllm-project vllmvLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting… | |
| CVE-2026-114054 | 21 Oct 2026 | CVSS 6.5 | vllm-project vllmvLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying… | |
| CVE-2026-114055 | 21 Oct 2026 | CVSS 7.5 | vllm-project vllmvLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to control multimodal processor… | |
| CVE-2026-114056 | 21 Oct 2026 | CVSS 4.3 | ArcadeData arcadedbArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and… | |
| CVE-2026-114057 | 21 Oct 2026 | CVSS 4.3 | ArcadeData arcadedbArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to… |
Page 10 of 168