Archive
20 June 2026
Vulnerabilities first published on this day (UTC), newest first.
22 results · Clear filters · Feed
-
Medium 6.1
AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields
AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item…
-
Medium 6.5
AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint
AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform ser…
-
Medium 6.8
AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter
AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter, which lacks isSSRFSafeURL() validation and accepts requests to…
-
Medium 4.3
vllm - Regular Expression Denial of Service in Multiple Components
vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint — are susceptible to ca…
-
Medium 4.7
Capgo - Open Redirect via confirmation_url Parameter
Capgo before 12.128.2 contains an open redirect vulnerability in the confirm-signup endpoint that allows attackers to redirect users to arbitrary external websites. The confirmation_url parameter is not validated, enabling attackers to craft malicious links f…
-
Medium 4.3
Capgo - App Existence Oracle via GET /statistics/app/:app_id
Capgo before 12.128.2 contains an information disclosure vulnerability in the GET /statistics/app/:app_id endpoint that allows app-limited API keys to distinguish existing sibling app IDs through differential error responses. Attackers can enumerate real app …
-
Medium 4.3
Cap-go - Broken Cursor Pagination in /private/devices Endpoint
Cap-go before 12.128.12 contains a broken cursor pagination vulnerability in the /private/devices endpoint on the Cloudflare/workerd path that allows authenticated attackers to cause duplicate-page loops and make later rows unreachable. Attackers with app.rea…
-
Medium 6.3
Capgo - Policy Enforcement Bypass in Webhook Management Endpoints via Non-Expiring API Keys
Capgo before 12.128.2 contains an authorization bypass vulnerability in webhook management endpoints that allows non-expiring API keys to bypass the require_apikey_expiration organization policy. The checkWebhookPermission function fails to call apikeyHasOrgR…
-
Medium 6.5
picklescan - Arbitrary File Creation via logging.FileHandler Deserialization
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting malicious pickle payload…
-
Medium 4.8
capacitor-native-biometric - Authentication Bypass via Unvalidated CryptoObject in onAuthenticationSucceeded
capacitor-native-biometric before 12.128.2 contains an authentication bypass vulnerability where the onAuthenticationSucceeded() method fails to validate CryptoObject parameters. Attackers can hook the onAuthenticationSucceeded() function using dynamic instru…
-
Medium 6.0
Flowise - Mass Assignment in PUT /api/v1/user Allows Password Hash Override
Flowise before 3.1.2 contains a mass assignment vulnerability in the PUT /api/v1/user endpoint that allows authenticated users to directly modify the credential field without validation. Attackers can bypass password change verification and session invalidati…
-
Medium 5.3
Capgo - Information Disclosure via Unauthenticated /replication Endpoint
Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /replication endpoint that exposes internal PostgreSQL replication telemetry including slot names and WAL LSN positions. Attackers can access this endpoint without a…
-
Medium 6.9
Flowise - PII Disclosure via Unauthenticated Forgot Password Endpoint
Flowise before 3.0.13 contains an information exposure vulnerability in the POST /api/v1/account/forgot-password endpoint that returns full user objects including PII to unauthenticated attackers. An attacker can enumerate valid email addresses and harvest se…
-
Medium 5.3
Capgo - Unauthenticated Cross-Tenant Metrics Disclosure via RPC Functions
Cap-go capgo before 12.128.2 contains an authorization bypass in several Supabase PostgREST RPC functions (get_app_metrics, get_global_metrics, get_total_metrics) that are granted to the anon role without enforcing org membership or permission checks. An unau…
-
Medium 5.4
Capgo - Server-Side Request Forgery via Webhook URL Validation
Capgo before 12.128.2 contains a server-side request forgery vulnerability in webhook URL validation that allows loopback and internal addresses. Organization admins can configure webhooks pointing to localhost or 127.0.0.1, and when triggered, the backend pe…
-
Medium 4.9
Capgo - Denial of Service via Improper Password Policy Length Validation
Capgo before 12.128.2 fails to enforce a maximum value on the minimum password length field in its password policy configuration. An authenticated organization administrator can set an extremely large numeric value (e.g., billions of characters) as the minimu…
-
Medium 5.3
Capgo - EXIF Metadata Exposure via Image Upload
Capgo before 12.128.2 fails to strip EXIF metadata including GPS geolocation data from uploaded images, allowing information disclosure. Attackers can download uploaded images and extract precise latitude and longitude coordinates revealing user physical loca…
-
Medium 6.1
Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows
Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g., <iframe src="javascrip…
-
Medium 5.9
Liquidfiles versions before 4.2.12 are affected by a broken access control vulnerability resulting in privilege escalat…
-
Medium 5.3
Panic in `bcrypt::verify` on non-ASCII hash input
`bcrypt::verify(password, hash)` and `HashParts::from_str(hash)` panic in `str::slice_error_fail` when given a 60-byte `&str` containing a multi-byte UTF-8 character at certain byte positions. ## Impact Any Rust code that calls `bcrypt::verify` (or `HashParts…
-
Medium 6.5
Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute
The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for authenticated attacke…
-
Medium 5.3
Capgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC
Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into version_meta for any app_id. Attackers…