Archive
15 January 2026
Vulnerabilities first published on this day (UTC), newest first.
72 results · Clear filters · Feed
-
Medium 6.2
MTPutty 1.0.1.21 - SSH Password Disclosure
MTPutty 1.0.1.21 contains a sensitive information disclosure vulnerability that allows local attackers to view SSH connection passwords through Windows PowerShell process listing. Attackers can run a PowerShell command to retrieve the full command line of MTP…
-
Medium 6.5
Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)
Arunna 1.0.0 contains a cross-site request forgery vulnerability that allows attackers to manipulate user profile settings without authentication. Attackers can craft a malicious form to change user details, including passwords, email, and administrative priv…
-
Medium 5.9
Libxml2: libxml2: denial of service via uncontrolled recursion in xml catalog processing
A flaw was found in libxml2, an XML parsing library. This uncontrolled recursion vulnerability occurs in the xmlCatalogXMLResolveURI function when an XML catalog contains a delegate URI entry that references itself. A remote attacker could exploit this config…
-
Medium 6.4
AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings
The AffiliateX – Amazon Affiliate Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_customization_settings AJAX action in versions 1.0.0 to 1.3.9.3. This makes it possible for authenti…
-
Medium 5.3
Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request
The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the kalium_vc_contact_form_request() function in all versions up to, and including, 3.29. This makes it …
-
Medium 4.3
Certain error messages returned by the application expose internal system details that should not be visible to end use…
-
Medium 5.3
The application discloses all used components, versions and license information to unauthenticated actors, giving attac…
-
Medium 5.3
Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft thro…
-
Medium 4.3
An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions th…
-
Medium 4.3
Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.
-
Medium 4.3
An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset withou…
-
Medium 4.3
An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing…
-
Medium 4.3
An attacker with limited permissions may still be able to write files to specific locations on the device, potentially …
-
Medium 4.3
Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead…
-
Medium 4.3
Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authenticati…
-
Medium 5.3
Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover cr…
-
Medium 5.4
WP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Select user profile fields in all versions up to, and including, 3.5.4.3 due to insufficient input sanitization and outpu…
-
Medium 6.1
Cross site scripting (XSS) vulnerability in Omnispace Agora Project before 25.10 allowing attackers to execute arbitrar…
-
Medium 4.9
An SQL injection vulnerability in Itflow through 25.06 has been identified in the "role_id" parameter when editing a pr…
-
Medium 6.1
Cross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code…
-
Medium 5.3
Directory traversal vulnerability in InvoicePlane through 1.6.3 allows unauthenticated attackers to read files from the…
-
Medium 6.5
An SQL injection vulnerability in InvoicePlane through 1.6.3 has been identified in "maxQuantity" and "minQuantity" par…
-
Medium 6.1
SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output.
-
Medium 5.4
A Stored Cross-Site Scripting (XSS) vulnerability in Web management interface in Each Italy Wireless Mini Router WIRELE…
-
Medium 6.5
A heap overflow in the avi_parse_input_file() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (Do…
-
Medium 5.5
A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service…
-
Medium 5.5
A heap overflow in the vorbis_to_intern() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) v…
-
Medium 6.1
A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0. An authenticated attacke…
-
Medium 6.1
A stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management System v1.0 within the use…
-
Medium 5.5
A stack overflow in the dmx_saf function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a craft…
-
Medium 5.5
A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) …
-
Medium 5.5
A stack overflow in the pcmreframe_flush_packet function of GPAC v2.4.0 allows attackers to cause a Denial of Service (…