Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:918"
689 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-54206 |
medium | 6.3 | 0.0049 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @ | |
CVE-2026-54207 |
medium | 6.3 | 0.0049 | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality (“!ArcEntryMove”) accepts an | |
CVE-2026-67620 |
medium | 6.3 | 0.0046 | 2026-08-08 | Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard impleme | |
CVE-2026-75054 |
medium | 6.3 | 0.0015 | 2026-08-17 | In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrus | |
CVE-2026-63642 |
medium | 6.3 | 0.0050 | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in de | |
CVE-2026-63643 |
medium | 6.3 | 0.0066 | 2026-08-18 | MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, the ADD_CALENDAR hand | |
CVE-2026-55162 |
medium | 6.3 | 0.0022 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.2, lemur/certificates/verify.py accepted CRL Di | |
CVE-2026-70667 |
medium | 6.3 | 0.0018 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, _validate_revocation_url in lemur/certificat | |
CVE-2026-115810 |
medium | 6.3 | 0.0024 | 2026-10-23 | Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle impo | |
CVE-2026-115717 |
medium | 6.3 | 0.0031 | 2026-10-26 | Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the con | |
CVE-2026-57448 |
medium | 6.2 | 0.0034 | 2026-10-28 | Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prio | |
CVE-2026-66325 |
medium | 6.1 | 0.0039 | 2026-08-03 | Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacke | |
CVE-2026-20041 |
medium | 6.1 | 0.0025 | 2026-04-01 | A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthent | |
CVE-2026-42184 |
medium | 6.1 | 0.0031 | 2026-05-27 | Tauri is a framework for building binaries for all major desktop platforms. From 2.0 to 2.11.0, a fl | |
CVE-2026-54663 |
medium | 6.1 | 0.0022 | 2026-07-29 | swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior t | |
CVE-2026-70620 |
medium | 6.1 | 0.0046 | 2026-08-04 | Odysseus before commit 87babb5 contains a server-side request forgery vulnerability that allows admi | |
CVE-2026-118766 |
medium | 6.1 | — | 2026-10-29 | Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HT | |
CVE-2026-118376 |
medium | 6.0 | 0.0027 | 2026-10-28 | WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that m | |
CVE-2026-41689 |
medium | 6.0 | 0.0018 | 2026-05-07 | Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, | |
CVE-2026-56275 |
medium | 6.0 | 0.0032 | 2026-06-23 | Flowise before 3.1.0 contains a server-side request forgery vulnerability in the Execute Flow node t | |
CVE-2026-16481 |
medium | 6.0 | 0.0019 | 2026-07-27 | A Server-Side Request Forgery (SSRF) and credential exfiltration vulnerability exists in the cloud-h | |
CVE-2026-67435 |
medium | 6.0 | 0.0050 | 2026-07-29 | linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integ | |
CVE-2026-66654 |
medium | 6.0 | 0.0021 | 2026-08-13 | Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions. | |
CVE-2026-32467 |
medium | 6.0 | 0.0021 | 2026-08-18 | Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions. | |
CVE-2026-65985 |
medium | 6.0 | 0.0046 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the | |
CVE-2026-8328 |
medium | 5.9 | 0.0046 | 2026-05-13 | The ftpcp() function in Lib/ftplib.py was not updated when CVE-2021-4189 was fixed. While makepasv( | |
CVE-2026-50127 |
medium | 5.9 | 0.0031 | 2026-06-10 | Weblate is a web based localization tool. From version 5.15 to before version 2026.6, Weblate's VCS_ | |
CVE-2026-58501 |
medium | 5.9 | 0.0041 | 2026-07-08 | Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbid_external is defined but not e | |
CVE-2026-114609 |
medium | 5.8 | 0.0025 | 2026-10-22 | fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automaticall | |
CVE-2026-56084 |
medium | 5.8 | 0.0021 | 2026-10-27 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release version | |
CVE-2026-116678 |
medium | 5.8 | 0.0033 | 2026-10-27 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultward | |
CVE-2026-115225 |
medium | 5.8 | 0.0024 | 2026-10-28 | The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailCh | |
CVE-2026-34981 |
medium | 5.8 | 0.0025 | 2026-04-06 | The whisperX API is a tool for enhancing and analyzing audio content. From 0.3.1 to 0.5.0, FileServi | |
CVE-2026-44363 |
medium | 5.8 | 0.0010 | 2026-05-13 | MISP modules are autonomous modules that can be used to extend MISP for new services. Prior to 3.0.7 | |
CVE-2026-53944 |
medium | 5.8 | 0.0033 | 2026-06-24 | Ghost is a Node.js content management system. From 6.0.9 until 6.21.1, when making an external reque | |
CVE-2026-55187 |
medium | 5.8 | 0.0035 | 2026-07-10 | Mailpit is an email testing tool and API for developers. Prior to 1.30.2, the remediation shipped fo | |
CVE-2026-47160 |
medium | 5.8 | 0.0029 | 2026-07-15 | Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.36.0, Vaultwarden's /icons/ | |
CVE-2026-45709 |
medium | 5.8 | 0.0032 | 2026-07-20 | Mailpit is an email testing tool and API for developers. The fix for GHSA-6jxm-fv7w-rw5j (CVE-2026-2 | |
CVE-2026-73243 |
medium | 5.8 | 0.0043 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unau | |
CVE-2026-48053 |
medium | 5.8 | 0.0038 | 2026-08-17 | Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoin | |
CVE-2026-111761 |
medium | 5.8 | 0.0059 | 2026-10-20 | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, Base | |
CVE-2025-71398 |
medium | 5.8 | 0.0033 | 2026-07-18 | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated us | |
CVE-2026-105713 |
medium | 5.7 | 0.0042 | 2026-10-13 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to p | |
CVE-2026-44520 |
medium | 5.7 | 0.0019 | 2026-05-14 | Docling-Graph turns documents into validated Pydantic objects, then builds a directed knowledge grap | |
CVE-2026-7025 |
medium | 5.5 | 0.0030 | 2026-04-26 | A vulnerability was found in Typecho up to 1.3.0. This vulnerability affects the function Service::s | |
CVE-2026-4953 |
medium | 5.5 | 0.0029 | 2026-03-27 | A weakness has been identified in mingSoft MCMS up to 5.5.0. This issue affects the function catchIm | |
CVE-2026-6604 |
medium | 5.5 | 0.0028 | 2026-04-20 | A vulnerability was identified in modelscope agentscope up to 1.0.18. Affected by this issue is the | |
CVE-2026-6605 |
medium | 5.5 | 0.0033 | 2026-04-20 | A security flaw has been discovered in modelscope agentscope up to 1.0.18. This affects the function | |
CVE-2026-6606 |
medium | 5.5 | 0.0028 | 2026-04-20 | A weakness has been identified in modelscope agentscope up to 1.0.18. This vulnerability affects the | |
CVE-2026-6625 |
medium | 5.5 | 0.0030 | 2026-04-20 | A security vulnerability has been detected in moxi624 Mogu Blog v2 up to 5.2. Affected by this vulne |