All CVEs — page 344 of 631

The complete archive, 25 per page, newest first. 15775 records. Search instead.

• UNSCOREDCVE-2026-865352026-10-02
• UNSCOREDCVE-2026-850882026-10-02
• UNSCOREDCVE-2026-850872026-10-02
• UNSCOREDCVE-2026-850862026-10-02
• UNSCOREDCVE-2026-824592026-10-02
• UNSCOREDCVE-2026-824582026-10-02
• UNSCOREDCVE-2026-613732026-10-02
• HIGH 7.3CVE-2026-104609public exploit available2026-10-02
• MEDIUM 6.1CVE-2026-104473public exploit available2026-10-02
• HIGH 7.5CVE-2026-104472public exploit available2026-10-02

  A missing authorization check in YesWiki's attachment download handler allows unauthenticated attackers to access confidential files from pages that should be restricted to specific users or groups. This vulnerability enables unauthorized data disclosure without requiring any authentication credentials.

• HIGH 7.2CVE-2026-104471public exploit available2026-10-02
• MEDIUM 5CVE-2026-104470public exploit available2026-10-02
• MEDIUM 6.8CVE-2026-104469public exploit available2026-10-02
• MEDIUM 4.8CVE-2026-104468public exploit available2026-10-02
• HIGH 8.1CVE-2026-104467public exploit available2026-10-02

  YesWiki before 4.6.7 allows unauthenticated attackers to bypass authorization and call admin-only API routes, potentially leading to configuration overwrites and data manipulation.

• MEDIUM 5.4CVE-2026-104466public exploit available2026-10-02
• MEDIUM 6.1CVE-2026-104465public exploit available2026-10-02
• HIGH 8.6CVE-2026-104464public exploit available2026-10-02

  YesWiki before 4.6.7 is vulnerable to server-side request forgery, allowing unauthenticated attackers to make unauthorized GET requests and potentially access internal or cloud metadata.

• HIGH 7CVE-2026-104463public exploit available2026-10-02
• HIGH 7.5CVE-2026-104462public exploit available2026-10-02

  YesWiki before 4.6.7 has an SQL injection vulnerability in its Bazar nuagetag action that allows attackers with page-write access to inject malicious SQL queries. This can lead to unauthorized data exposure including password hashes and arbitrary table data.

• MEDIUM 5.4CVE-2026-104461public exploit available2026-10-02
• HIGH 7.5CVE-2026-104460public exploit available2026-10-02

  A blind SQL injection vulnerability exists in YesWiki's {{newtextsearch}} action that allows anonymous attackers to extract database information by crafting malicious Bazar list option IDs. This occurs because option IDs are concatenated directly into SQL REGEXP/LIKE clauses without proper escaping, enabling attackers to use search requests as a boolean oracle for data extraction.

• MEDIUM 6.5CVE-2026-104459public exploit available2026-10-02
• MEDIUM 6.5CVE-2026-104458public exploit available2026-10-02
• HIGH 8.6CVE-2026-104457public exploit available2026-10-02

  The flaw allows unauthenticated attackers to inject SQL queries, potentially reading sensitive data such as password hashes.