Archive
16 June 2026
Vulnerabilities first published on this day (UTC), newest first.
115 results · Clear filters · Feed
-
Medium 4.7
CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters
CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is…
-
Medium 6.8
pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678)
Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. In versions 1.56.0 through 1.101.0, 2.0.0b1, and 2.0.0b2, the cloud-metadata blocklist could be bypassed by encoding the metadata IP in an IPv6 transition form…
-
Medium 6.5
Runtipi: Unauthenticated arbitrary file read through app-store logo symlinks
Runtipi is a personal homeserver orchestrator. In versions 4.9.1 through 4.9.3, Runtipi serves marketplace app logos from files inside cloned app-store repositories through an unauthenticated endpoint, which leads to arbitrary file read through app-store logo…
-
Medium 4.8
Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription
Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifyin…
-
Medium 5.6
Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling
A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper valida…
-
Medium 6.5
WordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability
Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.
-
Medium 6.5
WordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Genemy <= 1.6.6 versions.
-
Medium 4.2
LangGraph SDK has unsafe URL path construction
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. Versions 0.3.14 and prior have unsafe URL path construction through unsanitized caller-supplied identifier values us…
-
Medium 6.5
Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Integration and…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported ve…
-
Medium 6.5
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is …
-
Medium 6.5
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). Supported versions that are…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported ve…
-
Medium 6.5
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported…
-
Medium 6.1
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
Medium 5.3
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supp…
-
Medium 4.7
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF…
-
Medium 4.1
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Jav…
-
Medium 6.0
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported ve…
-
Medium 6.1
Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Sec…
-
Medium 6.6
Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that …
-
Medium 6.5
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supp…
-
Medium 6.5
In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. …
-
Medium 4.0
In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to …
-
Medium 4.3
In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote …
-
Medium 5.3
In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to re…
-
Medium 4.0
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local informatio…
-
Medium 4.0
In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This coul…
-
Medium 5.3
In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to…
-
Medium 4.3
In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remot…
-
Medium 4.0
In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic err…
-
Medium 4.3
In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to…
-
Medium 4.3
In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote informa…
-
Medium 4.3
In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead…
-
Medium 6.5
In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memor…
-
Medium 5.7
Reflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS). This issue affects Employee Access Center: 23.10. It is possible to add in javas…
-
Medium 6.5
Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments vi…
-
Medium 4.3
Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated …
-
Medium 4.3
Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authentica…
-
Medium 4.2
OpenClaw < 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening
OpenClaw before 2026.5.12 contains a bootstrap token replay vulnerability allowing callers with pending token access to reuse tokens with broader requested scopes. Attackers can replay bootstrap tokens before approval to escalate pairing authority beyond inte…