All CVEs — page 293 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows an attacker to modify collection documents in a headless content management system without proper access control, leading to unauthorized data changes.
A remote code execution vulnerability exists in a headless CMS where an attacker can execute arbitrary code by sending a crafted request to the public first-register endpoint when local authentication is enabled and no initial user exists. This allows full system compromise with high severity.
The flaw allows an attacker to execute remote code via a specially crafted form submission, posing a critical risk.
The MCP TypeScript SDK has a critical flaw in its OAuth client implementation where stored credentials are not bound to their originating authorization server. This allows malicious or compromised MCP servers to trick clients into sending refresh tokens and client secrets to wrong authorization servers, potentially leading to unauthorized access to user accounts.
This vulnerability allows unauthenticated attackers to modify arbitrary object fields and potentially execute arbitrary PHP code, leading to full control over the web application.
The flaw allows the management interface of Dbit WIFI4 N300 1.0.0 devices to crash via a local Wi-Fi request missing the username or password field, due to an error in the JSON parser.
The vulnerability stems from insufficiently random values being used in Dell Container Storage Modules, which could allow an unauthenticated attacker with local access to tamper with information. This poses a risk to data integrity and potentially allows unauthorized modifications to storage configurations or data.
This vulnerability allows a low-privileged attacker to exploit an Improper Neutralization of Special Elements Used in a Template Engine flaw, potentially leading to Elevation of Privileges.
The Dell Container Storage Modules (CSM) proxy-server component has a certificate validation flaw that allows adjacent network attackers to potentially steal administrator credentials from storage backends. This vulnerability affects versions prior to 1.18.0 and can lead to unauthorized access to critical storage infrastructure.