Archive
18 March 2026
Vulnerabilities first published on this day (UTC), newest first.
10 results · Clear filters · Feed
-
Low 2.3
Unpacking Arbitrary Mustache Template Files via `maven-dependency-plugin`
openapi-to-java-records-mustache-templates allows users to generate Java Records from OpenAPI specifications. Starting in version 5.1.1 and prior to version 5.5.1, the parent POM file of this project (`openapi-to-java-records-mustache-templates-parent`), whic…
-
Low 2.3
Parse Server has a password reset token single-use bypass via concurrent requests
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password r…
-
Low 2.1
Out-of-bounds array write in Xpdf 4.06 due to missing validation
Out-of-bounds array write in Xpdf 4.06 and earlier, due to incorrect validation of the "N" field in ICCBased color spaces.
-
Low 3.6CVE-2026-32722 Public exploit
Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata
Memray is a memory profiler for Python. Prior to Memray 1.19.2, Memray rendered the command line of the tracked process directly into generated HTML reports without escaping. Because there was no escaping, attacker-controlled command line arguments were inser…
-
Low 2.7
StudioCMS REST getUsers Exposes Owner Account Records to Admin Tokens
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.4, the REST API `getUsers` endpoint in StudioCMS uses the attacker-controlled `rank` query parameter to decide whether owner accounts should be filtered from t…
-
Low —
mo has a XSS via inline SVG script tags in Markdown rendering
### Summary When rendering Markdown files containing inline SVG elements with `<script>` tags, the embedded JavaScript is executed in the browser. This is due to `rehype-raw` passing raw HTML (including SVG) through to the DOM without sanitization. ### PoC ``…
-
Low —
Improper detection of disallowed URIs by Loofah `allowed_uri?`
## Summary `Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` URIs when the scheme is split by HTML entity-encoded control characters such as ` ` (carriage return), ` ` (line feed), or `	` (tab). ## Details The `allowed_uri…
-
Low 2.4
A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may …
-
Low 2.4
Google Cloud Storage for Craft CMS has an Information Disclosure Vulnerability
The Google Cloud Storage for Craft CMS plugin provides a Google Cloud Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.2.1, the `DefaultController->actionLoadBucketData()` endpoint allows unauthenticated users with a valid CSRF toke…
-
Low 2.4
itsourcecode University Management System add_result.php cross site scripting
A flaw has been found in itsourcecode University Management System 1.0. Affected is an unknown function of the file /add_result.php. Executing a manipulation of the argument vr can lead to cross site scripting. The attack may be launched remotely. The exploit…