Archive
29 May 2026
Vulnerabilities first published on this day (UTC), newest first.
94 results · Clear filters · Feed
-
Medium 6.3
ExtremeCloud IQ Cross Tenant Data Exposure via Extreme Platform One Authentication Race Condition
A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under specific high-concurrency traffic conditions, intermittently allow requests authenticated with an Extreme Platform ONE /IAM-issued API key to receive resp…
-
Medium 5.3
Nerdbank.MessagePack has Inefficient CPU Computation
### Impact Applications that call `OptionalConverters.WithExpandoObjectConverter` and deserialize untrusted data are open to a vulnerability by which an attacker can exploit a `O(n²)` algorithm to burn an inordinate amount of CPU effort by adding a great many…
-
Medium 5.3
Nerdbank.MessagePack has a memory amplification DoS in collection deserialization
Nerdbank.MessagePack deserializers for many collection-shaped types trusted the element count declared in MessagePack array and map headers when allocating destination storage. A crafted payload could therefore force large arrays, pooled buffers, dictionaries…
-
Medium 6.5
brace-expansion: Large numeric range defeats documented `max` DoS protection
The brace-expansion library generates arbitrary strings containing a common prefix and suffix. From 5.0.0 to before 5.0.6, the max option was being applied too late. When expanding a single large numeric range like {1..10000000}, the sequence generation loop …
-
Medium 5.3
FreeScout: User Account Enumeration via Password Reset Response Differentiation
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.219, the password reset endpoint returns visually distinct responses depending on whether the submitted email address belongs to an existing user account, allowing…
-
Medium 4.3
FreeScout: Thread Edit Authorization Bypass via Missing Mailbox Check
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, while investigating the ThreadPolicy::delete issue reported previously, the same missing mailbox membership check was found in the sibling ThreadPolicy::edit …
-
Medium 4.3
FreeScout: Thread Deletion Bypasses Mailbox Access Revocation
FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note (private thread) from any conversation, even after that user's access to the mailbox …
-
Medium 6.5
go-git: Malformed Git object data may cause panics or resource exhaustion
### Impact Several denial-of-service issues were identified in `go-git` when parsing maliciously crafted Git repository data. An attacker may craft a malicious `.pack`, `.idx` or loose objects that causes an application using an affected version of `go-git` t…
-
Medium 6.3
FastGPT: sandbox escape to RCE - code-sandbox regex /\bimport\s*\(/ is bypassable
FastGPT is an AI Agent building platform. Prior to 4.15.0-beta1, the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356 blocks dynamic import() with the regex /\bimport\s*\(/.test(code). JavaScript syntax accepts a block comment between…
-
Medium 4.5
NanoMQ: QUIC Dialer Close Type Confusion
NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to 0.24.14, aio->prov_data is stored as nni_quic_conn* during dialing, but read as ex_quic_conn* during dialer close. This type confusion causes invalid object interpretation and lead…
-
Medium —
tar has a PAX header desynchronization issue
### Summary When a tar stream contains multiple "header" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result…
-
Medium 5.3
cpp-httplib DoS: Negative chunk-size in chunked Transfer-Encoding
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.43.4, negative chunk-size in chunked Transfer-Encoding causes unbounded memory allocation and process crash. The ChunkedDecoder::read_payload function in cpp-httplib …
-
Medium —
astral-tokio-tar has a PAX Header Desynchronization issue
### Impact Versions of astral-tokio-tar prior to 0.6.2 contain a PAX header interpretation bug that allows manipulated entries to be made selectively visible or invisible during extraction with astral-tokio-tar versus other tar implementations. An attacker co…
-
Medium 5.5
CAPM3 vulnerable to Cross-Namespace resource access
## Summary CAPM3 is Metal3's Cluster API (CAPI) provider for baremetal provisioning in Kubernetes. Multiple cross-namespace access control vulnerabilities in Cluster API Provider Metal3 allow users with permissions to create or modify CAPM3 resources in one n…
-
Medium 5.3
Stored Cross-Site Scripting (XSS) via Configuration File Import on TP-Link's TL-SG108PE
A stored cross-site scripting (XSS) vulnerability has been identified in the web management interface of TP-Link's TL-SG108PE v5 switch due to improper sanitation of the SYSNAM configuration parameter during configuration file import. An attacker with adminis…
-
Medium 5.3
Panic when reading out of bound palette index in golang.org/x/image/bmp
Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.
-
Medium 4.3
Ironic Standalone Operator's controller modifies user-owned resources without consent
## Impact The Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. IRSO controller automatically adds its environment label to user-provided Secrets and ConfigMaps without the resource owner's consent. A high-privileg…
-
Medium 4.3
Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces
## Impact The Ironic Standalone Operator (IRSO) is the operator to maintain an Ironic deployment for Metal3. The Prometheus metrics exporter binds to 0.0.0.0 (all network interfaces) by default with no authentication. The default config is disabled. If enable…
-
Medium 6.5
In JetBrains YouTrack before 2026.1.13570 improper access control allowed enumeration of restricted issues and articles…
-
Medium 6.5
In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accoun…
-
Medium 6.1
In JetBrains PyCharm before 2025.3.4 stored XSS in Jupyter notebook Markdown cells was possible
-
Medium 4.5
In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright plugin
-
Medium 4.3
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
-
Medium 6.5
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
-
Medium 4.3
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
-
Medium 6.1
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
-
Medium 6.5
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
-
Medium 4.3
In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on Users and Groups pages
-
Medium 5.3
liboqs: Heap-buffer-overflow in XMSS verification path via OID-controlled parameter mismatch (xmss_commons.c:194)
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification …
-
Medium 5.3
liboqs: XMSS Buffer Overread Bug
liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. Prior to 0.16.0, an out-of-bounds read has been identified in the XMSS and XMSS^MT stateful signature verification code. When the verification …
-
Medium 5.9
Shopper: Race condition on Discount.usage_limit allows silent over-redemption
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, CreateOrderFromCartAction::execute previously created the Order row before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, …
-
Medium 6.5
Shopper: Missing authorization on Product admin Livewire sub-form components
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regardless of role, could…
-
Medium 6.5
Shopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables
Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticated panel user withou…
-
Medium 6.9
SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, when fetch(url) throws, the code sends: res.status(500).sen…
-
Medium 5.7
MacGregor Voyage Data Recorder (VDR) G4e Files or Directories Accessible to External Parties
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.
-
Medium 6.9
SillyTavern: SSRF vulnerability in the CORS proxy middleware
SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation engines, and text-to-speech voice models. Prior to 1.18.0, corsProxyMiddleware forwards req.params.url directly into f…
-
Medium 5.4
MacGregor Voyage Data Recorder (VDR) G4e Use of Password Hash With Insufficient Computational Effort
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
-
Medium 5.4
MacGregor Voyage Data Recorder (VDR) G4e Insufficiently Protected Credentials
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.
-
Medium 6.3
Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter
Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/{id}/volumes/{volumeName}/browse accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside …
-
Medium 6.9
Neotoma: Unauthenticated Inspector/API access via reverse-proxy loopback auth bypass
Neotoma provides versioned records that persist across agent runs. From 0.6.0 to before 0.11.1, Neotoma can treat public reverse-proxied requests as local when the app receives them over a loopback socket and no Bearer token is present. In affected deployment…