Archive
2 February 2026
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
Critical 10.0
SandboxJS Prototype Pollution -> Sandbox Escape -> RCE
SandboxJS is a JavaScript sandboxing library. Prior to 0.8.27, SanboxJS does not properly restrict __lookupGetter__ which can be used to obtain prototypes, which can be used for escaping the sandbox / remote code execution. This vulnerability is fixed in 0.8.…
-
Critical 9.1CVE-2026-25137 EPSS 10%
NixOs Odoo database and filestore publicly accessible with default odoo configuration
The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire…
-
Critical 9.4
Group-Office Argument Injection in MaintenanceController::actionZipLanguage
Group-Office is an enterprise customer relationship management and groupware tool. Prior to 6.8.150, 25.0.82, and 26.0.5, the MaintenanceController exposes an action zipLanguage which takes a lang parameter and passes it directly to a system zip command via e…
-
Critical 9.8
Wildfire has Arbitrary File Upload via Directory Traversal in UploadFileAction
Wildfire IM is an instant messaging and real-time audio/video solution. Prior to 1.4.3, a critical vulnerability exists in the im-server component related to the file upload functionality found in com.xiaoleilu.loServer.action.UploadFileAction. The applicatio…
-
Critical 9.8
vLLM leaks a heap address when PIL throws an error
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a heap address. With this l…
-
Critical 10.0
RCE - Command Injection in Signal K set-system-time plugin
Signal K Server is a server application that runs on a central hub in a boat. Prior to 1.5.0, a command injection vulnerability allows authenticated users with write permissions to execute arbitrary shell commands on the Signal K server when the set-system-ti…
-
Critical 9.3
Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')
continuwuity is a Matrix homeserver written in Rust. This vulnerability allows an attacker with a malicious remote server to cause the local server to sign an arbitrary event upon user interaction. Upon a user account leaving a room (rejecting an invite), joi…
-
Critical 9.8
Multiple Innomic VibroLine VLX HD 5.0 and avibia AVLX weak password requirements
An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforced.
-
Critical 9.1
Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3
A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject attacker-controlled data as the header of an empty file, which is then …
-
Critical 9.6
Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui
A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `name` parameter of the `@router.post("/reinstall_extension")` route. This vulnerability allows attacker…
-
Critical 9.6
Account Hijacking via Password Reset Token Leak in lunary-ai/lunary
In lunary-ai/lunary version 1.2.2, an account hijacking vulnerability exists due to a password reset token leak. A user with a 'viewer' role can exploit this vulnerability to hijack another user's account by obtaining the password reset token. The vulnerabili…
-
Critical 9.8
In Thread, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation …
-
Critical 9.3
In wlan STA driver, there is a possible escalation of privilege due to a missing bounds check. This could lead to local…
-
Critical 9.8CVE-2025-15030 Public exploit
User Profile Builder < 3.15.2 - Unauthenticated Arbitrary Password Reset
The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the password of any user by knowing their username, such as administrator ones, and therefore gain access t…
-
Critical 9.8
The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInf…
-
Critical 9.8
A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to St…