Archive
13 February 2026
Vulnerabilities first published on this day (UTC), newest first.
25 results · Clear filters · Feed
-
Medium —
Cloudflare Agents has a Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site
## Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The error_description query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers t…
-
Medium —
rPGP's integrity protection of encrypted data was not always checked
### Summary For some messages, rPGP returned incorrectly decrypted data without signaling that integrity protection was invalid. ### Details When decrypting SEIPD (Symmetrically Encrypted and Integrity Protected Data Packet), rPGP previously did not under all…
-
Medium 5.4
Vim has a Netbeans specialKeys Stack Buffer Overflow
Vim is an open source, command line text editor. Prior to 9.1.2148, a stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command, affecting Vim builds that enable and use the NetBeans feature. The Stack bu…
-
Medium 4.9CVE-2026-25964 Public exploit
Tandoor Recipes Affected by Authenticated Local File Disclosure (LFD) via Recipe Import leads to Arbitrary File Read
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.5.1, a Path Traversal vulnerability in the RecipeImport workflow of Tandoor Recipes allows authenticated users with import permissions to read arbi…
-
Medium 5.5
The BACnet Protocol Stack library has an Off-by-one Stack-based Buffer Overflow in tokenizer_string
BACnet Protocol Stack library provides a BACnet application layer, network layer and media access (MAC) layer communications services. In 1.4.2, 1.5.0.rc2, and earlier, an off-by-one stack-based buffer overflow in the ubasic interpreter causes a crash (SIGABR…
-
Medium 5.8
Local privilege escalation in Genetec Sipelia Plugin. An authenticated low-privileged Windows user could exploit this v…
-
Medium 5.3
beautiful-mermaid < 0.1.3 SVG Attribute Injection
beautiful-mermaid versions prior to 0.1.3 contain an SVG attribute injection issue that can lead to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams. User-controlled values from Mermaid style and classDef directives are interpola…
-
Medium —
sqlparse: formatting list of tuples leads to denial of service
### Summary The below gist hangs while attempting to format a long list of tuples. This was found while [drafting a regression test for Dja ngo 5.2's composite primary key feature](https://code.djangoproject.com/ticket/36416#comment:3), which allows querying …
-
Medium 6.1
Improper Access Control Allows Denial of Service
A vulnerability has been identified where weak file permissions in the Nessus Agent directory on Windows hosts could allow unauthorized access, potentially permitting Denial of Service (DoS) attacks.
-
Medium 4.3
Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authent…
-
Medium 5.1
HP App – Potential Cross-Site Scripting
HP App for Android is potentially vulnerable to cross-site scripting (XSS) when using an outdated version of the application via mobile devices. HP is releasing updates to mitigate these potential vulnerabilities.
-
Medium 5.3
Libsoup: out-of-bounds read in libsoup handle_partial_get() leading to heap information disclosure
A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote at…
-
Medium 4.3
Insufficient Authorization in Mattermost Jira Plugin Allows Unauthorized Access to Post Attachments
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 fail to validate user permissions when creating Jira issues from Mattermost posts, which allows an authenticated attacker with access to the Jira plugin to read post content and attach…
-
Medium 4.3
RegistrationMagic <= 6.0.7.2 - Subscriber+ Sensitive Data Disclosure
The RegistrationMagic WordPress plugin before 6.0.7.2 checks nonces but not capabilities, allowing for the disclosure of some sensitive data to subscribers and above.
-
Medium 6.0
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected prod…
-
Medium 6.0
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected prod…
-
Medium 6.0
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected prod…
-
Medium 6.0
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected prod…
-
Medium 6.0
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected prod…
-
Medium 6.0
A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected prod…
-
Medium 6.2
Reflected Cross-Site Scripting (XSS) vulnerability in AI Playground site
Summary A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the AI Playground's OAuth callback handler. The `error_description` query parameter was directly interpolated into an HTML script tag without proper escaping, allowing attackers to…
-
Medium 6.2CVE-2025-66676 Public exploit
An issue in IObit Unlocker v1.3.0.11 allows attackers to cause a Denial of Service (DoS) via a crafted request.
-
Medium 6.5
A cross-site scripting (XSS) vulnerability in the Customers function of OpenSourcePOS v3.4.1 allows attackers to execut…
-
Medium 6.5
A cross-site scripting (XSS) vulnerability in the Generate Item Barcode function of OpenSourcePOS v3.4.1 allows attacke…
-
Medium 6.5
A cross-site scripting (XSS) vulnerability in the item management and sales invoice function of OpenSourcePOS v3.4.1 al…