Archive
28 June 2026
Vulnerabilities first published on this day (UTC), newest first.
11 results · Clear filters · Feed
-
Low 2.4
Chess Play and Learn App com.chess AndroidManifest.xml backup
A weakness has been identified in Chess Play and Learn App up to 4.9.42 on Android. This issue affects some unknown processing of the file AndroidManifest.xml of the component com.chess. This manipulation causes exposure of backup file to an unauthorized cont…
-
Low 3.1
VoltAgent Memory REST API memory.handlers.ts handleGetMemoryConversation improper authorization
A vulnerability was determined in VoltAgent up to 2.1.17. Affected by this issue is the function handleGetMemoryConversation of the file packages/server-core/src/handlers/memory.handlers.ts of the component Memory REST API. Executing a manipulation of the arg…
-
Low 3.7
SimStudioAI sim Password Protection deployment.ts weak hash
A vulnerability was found in SimStudioAI sim up to 0.6.92. Affected by this vulnerability is an unknown functionality in the library apps/sim/lib/core/security/deployment.ts of the component Password Protection Handler. Performing a manipulation results in us…
-
Low 3.5
code-projects Project Management System Mail Compose mail.php cross site scripting
A vulnerability has been found in code-projects Project Management System 1.0. This vulnerability affects unknown code of the file /mail.php of the component Mail Compose Page. Such manipulation leads to cross site scripting. The attack may be performed from …
-
Low 3.1
AIDC-AI ComfyUI-Copilot Workflow Checkpoint Restore conversation_api.py resource injection
A flaw has been found in AIDC-AI ComfyUI-Copilot up to 2.0.28. This issue affects some unknown processing of the file backend/controller/conversation_api.py of the component Workflow Checkpoint Restore Handler. Executing a manipulation can lead to improper co…
-
Low 3.7
78 xiaozhi-esp32 MQTT Goodbye mqtt_protocol.cc GetInstance denial of service
A vulnerability was detected in 78 xiaozhi-esp32 up to 2.2.6. This vulnerability affects the function Application::GetInstance of the file main/protocols/mqtt_protocol.cc of the component MQTT Goodbye Handler. Performing a manipulation of the argument session…
-
Low 3.7
glpi-project glpi Document document.send.php canViewFile authorization
A security vulnerability has been detected in glpi-project glpi 11.0.5/11.0.6/11.0.7. This affects the function Document::canViewFile of the file front/document.send.php of the component Document Handler. Such manipulation of the argument docid leads to autho…
-
Low 3.1
78 xiaozhi-esp32 MCP Response mcp_server.cc ParseMessage improper synchronization
A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of…
-
Low 3.1
arc53 DocsGPT Credential Storage encryption.py encrypt_credentials data authenticity
A flaw has been found in arc53 DocsGPT up to 0.18.0. The affected element is the function encrypt_credentials of the file application/security/encryption.py of the component Credential Storage. This manipulation causes insufficient verification of data authen…
-
Low 3.7
skypilot-org skypilot User ID server.py username.encode weak hash
A vulnerability was detected in skypilot-org skypilot up to 0.12.0. Impacted is the function username.encode of the file sky/users/server.py of the component User ID Handler. The manipulation results in use of weak hash. The attack may be performed from remot…
-
Low 3.3
7-Zip - Mark-of-the-Web Bypass via RAR5 Alternate Data Stream Name Collision
7-Zip for Windows through 26.01 fails to preserve the Mark-of-the-Web when extracting a crafted RAR5 archive, because its guard that suppresses an archive-supplied Zone.Identifier stream matches the exact name 'Zone.Identifier' while a RAR5 STM record named '…