Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
5.4 MEDIUM
CVE-2026-86178 — Pixelfed through 0.12.9 Unauthorized Story Access via API

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate …

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
8.8 HIGH
CVE-2026-86177 — Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands.…

panel | Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.3 MEDIUM
CVE-2026-86176 — NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bookmarks. Authenticated users with view permissions can acce…

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
7.1 HIGH
CVE-2026-86175 — NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs

NetBox through 4.7.0 fails to redact sensitive data source backend credentials in REST and GraphQL API responses. Authenticated users with only view permission can retrieve plaintext passwords and se…

Remote | Information Disclosure
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.3 MEDIUM
CVE-2026-86174 — Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces …

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
8.7 HIGH
CVE-2026-86173 — MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler

MindsDB through 26.1.0 contains a server-side request forgery vulnerability in the web crawler handler that allows unauthenticated attackers to fetch arbitrary URLs by supplying caller-controlled URL…

Remote | Server-Side Request Forgery
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
8.8 HIGH
CVE-2026-86169 — Axolotl through 0.18.0 Remote Code Execution via Multipack Patching

Axolotl through 0.18.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None instead of False, causing the security guard to be bypassed.…

Remote | Injection
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
9.8 CRITICAL
CVE-2026-86124 — AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server

AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attacker-supplied commands as root. Attackers can connect to the …

Remote | Authentication
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
9.4 CRITICAL
CVE-2026-86123 — SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints

SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can conne…

Remote | Server-Side Request Forgery
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.3 MEDIUM
CVE-2026-86122 — Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server

Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations. Attackers can point these URLs at internal services and c…

rowboat | Remote | Server-Side Request Forgery
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
9.8 CRITICAL
CVE-2026-86121 — Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINER_NAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execu…

Remote | Authentication
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.3 MEDIUM
CVE-2026-86120 — APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission …

APITable through 1.13.0-beta.1 contains an incorrect authorization vulnerability in NodePermissionGuard that fails to enforce node-level access control when permission lookups throw exceptions. Attac…

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
9.2 CRITICAL
CVE-2026-86119 — Webstudio through 0.296.0 SSRF via /cgi proxy routes

Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when RESIZE_ORIGIN environment variable is u…

Remote | Server-Side Request Forgery
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.3 MEDIUM
CVE-2026-86118 — gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the s…

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
9.2 CRITICAL
CVE-2026-86117 — Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching

Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts based solely on email address without verifying provider a…

coolify | Remote | Authentication
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
7.1 HIGH
CVE-2026-86116 — Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API

Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, and delete glossary entries. Attackers can…

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.3 MEDIUM
CVE-2026-86115 — Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-…

Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation and minting internal authentication tokens. Authenticated wo…

Remote | Server-Side Request Forgery
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
7.1 HIGH
CVE-2026-86114 — Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation …

Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates including instance-wide defaults. Attac…

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
7.1 HIGH
CVE-2026-86113 — BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tamper…

BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to modify other users' reading records. Attackers can exploit se…

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
5.4 MEDIUM
CVE-2026-86112 — BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints

BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers to favorite or unfavorite followers-only and direct statuse…

Remote | Authorization
Sep 05, 2026 Sep 05, 2026
Sep 05, 2026
Sep 05, 2026
Showing 20 of 12639 Results