Export limit exceeded: 418478 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418478 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121432 | 1 Azuracast | 1 Azuracast | 2026-11-03 | 3.5 Low |
| AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject playlist entries by embedding CR/LF sequences in mount or remote relay display_name values. Attackers with Station:MountPoints or Station:RemoteRelays permission can inject FileN= and TitleN= lines into the public playlist.pls to redirect guest listeners to attacker-controlled streams under the victim station's name. | ||||
| CVE-2026-121431 | 1 Azuracast | 1 Azuracast | 2026-11-03 | 5.3 Medium |
| AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks permission to bypass the UserUrlFilter guard via the Mastodon, Telegram, GroupMe, and RadioReg connectors. Attackers can set instance_url, api, or webhookurl to internal addresses and trigger the webhook test endpoint to reach loopback, private-network, or cloud-metadata services. | ||||
| CVE-2026-121430 | 1 Azuracast | 1 Azuracast | 2026-11-03 | 5.4 Medium |
| AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST /api/station/{station_id}/waveform/{media_id} routes, which lack Permissions middleware. Any authenticated user without station assignment can read another station's cached waveform JSON and overwrite it with attacker-supplied data, corrupting Visual Cue Editor data. | ||||
| CVE-2026-121429 | 1 Azuracast | 1 Azuracast | 2026-11-03 | 8.8 High |
| AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container. | ||||
| CVE-2026-121428 | 1 Azuracast | 1 Azuracast | 2026-11-03 | 8.8 High |
| AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates. | ||||
| CVE-2026-121427 | 1 Azuracast | 1 Azuracast | 2026-11-03 | 7.5 High |
| AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend. | ||||
| CVE-2026-121426 | 1 Nodemailer | 1 Nodemailer | 2026-11-03 | 6.5 Medium |
| Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content. | ||||
| CVE-2026-121425 | 1 Nodemailer | 1 Nodemailer | 2026-11-03 | 6.5 Medium |
| Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists. | ||||
| CVE-2026-121424 | 1 Nodemailer | 1 Nodemailer | 2026-11-03 | 6.5 Medium |
| Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser. | ||||
| CVE-2026-121423 | 1 Surrealdb | 1 Surrealdb | 2026-11-03 | 6.5 Medium |
| SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants. | ||||
| CVE-2026-121422 | 1 Surrealdb | 1 Surrealdb | 2026-11-03 | 4.1 Medium |
| SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to bypass port-specific deny-net rules by using JWKS URLs with implicit default ports. Attackers can configure a JWT or record access method whose JWKS URL omits port 80 or 443, causing blind GET requests to explicitly denied internal services. | ||||
| CVE-2026-121421 | 1 Surrealdb | 1 Surrealdb | 2026-11-03 | 4.3 Medium |
| SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching because port-specific --deny-net rules (HOST:PORT or IP:PORT) match only a literal host string, while the resolved-IP check discards the port. Authenticated users can call http::* functions with a hostname resolving to a denied IP, or the IP of a denied hostname, to reach blocked internal services. | ||||
| CVE-2026-121420 | 1 Surrealdb | 1 Surrealdb | 2026-11-03 | 3.3 Low |
| SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver is_private_ip check that fails to unwrap NAT64, 6to4, and Teredo IPv6 addresses. Authenticated users triggering outbound HTTP requests via SurrealQL http functions can use transition addresses embedding private IPv4 targets to reach localhost, internal services, or cloud metadata endpoints. | ||||
| CVE-2026-121419 | 1 Surrealdb | 1 Surrealdb | 2026-11-03 | 8.1 High |
| SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions. | ||||
| CVE-2026-121418 | 1 Surrealdb | 1 Surrealdb | 2026-11-03 | 4.3 Medium |
| SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer restricted field values because the streaming planner uses indexes on fields with restrictive SELECT permissions. Attackers can issue full-text MATCHES, compound B-tree, or HNSW KNN queries against restricted fields to learn which records contain guessed values or nearest vectors. | ||||
| CVE-2026-121417 | 1 Surrealdb | 1 Surrealdb | 2026-11-03 | 7.8 High |
| SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption. | ||||
| CVE-2026-121416 | 1 Surrealdb | 1 Surrealdb | 2026-11-03 | 7.1 High |
| SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials. | ||||
| CVE-2026-121415 | 1 Parseplatform | 1 Parse-server | 2026-11-03 | 3.7 Low |
| Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields. | ||||
| CVE-2026-121414 | 1 Parseplatform | 1 Parse-server | 2026-11-03 | 5.9 Medium |
| Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process. | ||||
| CVE-2026-121413 | 1 Parseplatform | 1 Parse-server | 2026-11-03 | 3.1 Low |
| Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade endpoint, which creates a new session for any valid session token without enforcing the _Session class create class-level permission. Attackers holding a user's session token can send an already revocable token to /upgradeToRevocableSession to obtain additional sessions with fresh expiration that persist after the original session is logged out. | ||||