Archive
27 July 2026
Vulnerabilities first published on this day (UTC), newest first.
168 results · Clear filters · Feed
-
Medium 6.3
Next.js: Unbounded Server Action payload in Edge runtime
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consump…
-
Medium 6.9
Audit Log Exposure through Unauthorized Access
Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability that could allow an attacker to access audit logs without authentication, potentially resulting in t…
-
Medium 6.6
Out-of-bounds write in Zephyr `log_filter_set` syscall verifier reachable from userspace
The userspace verifier z_vrfy_log_filter_set() for the log_filter_set syscall in subsys/logging/log_mgmt.c performed a signed comparison against the int16_t src_id parameter: src_id < (int16_t)log_src_cnt_get(domain_id). Any negative value for src_id (e.g. -1…
-
Medium 5.4
Ekushey Project Manager CRM 5.0 Stored XSS via Reply Ticket Field
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft…
-
Medium 5.4
Ekushey Project Manager CRM 5.0 Stored XSS via Ticket Title Field
Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New T…
-
Medium 5.4
Ekushey Project Manager CRM 5.0 Stored XSS via Client Name Field
Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the client Name field on the Edit Profile p…
-
Medium 6.7
Ekushey Project Manager CRM 5.0 Missing Uniqueness Constraint via Client Email
Ekushey Project Manager CRM through version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password credentials. Attackers can exploit the lack o…
-
Medium 5.4
Papra: Cross-organization tag deletion and modification via authenticated cross-tenant request
Papra is a minimalistic document management and archiving platform. Prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The route handle…
-
Medium 6.3
Next.js: Denial of Service in the Image Optimization API using SVGs
Next.js is a React framework for building full-stack web applications. In versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting Next.js with the default image loader, the Image Optimization API can optimize remotely hosted images if co…
-
Medium 6.3
Next.js: Unauthenticated Disclosure of Internal Server Function endpoints
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, Next.js applications using App Router, Server Actions (use server) or use cache endpoints can be disclosed bypassing any auth…
-
Medium 4.3
Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privile…
-
Medium 4.3
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only pe…
-
Medium 6.9
ip-address: Misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks
ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Versions 10.1.1 through 10.2.0 are vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. Address6.getType() classifies an address by matchi…
-
Medium 6.5
org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages
### Impact It's possible to forge a request to delete a message. ### Patches The problem has been patched in version 2.0-rc-1 of Discussion Extension. ### Workarounds There's no easy workaround except upgrading. ### References https://jira.xwiki.org/browse/DI…
-
Medium 6.5
Apache Wicket: leaked and missing CSP headers
Use of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the iss…
-
Medium 6.1
Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, …
-
Medium 5.0
unitedbyai droidclaw Unsigned Scheduled Callback goals.ts authorization
A weakness has been identified in unitedbyai droidclaw up to 0.5.3. Affected by this issue is some unknown functionality of the file server/src/routes/goals.ts of the component Unsigned Scheduled Callback. This manipulation causes authorization bypass. Remote…
-
Medium 6.3
AstrBotDevs AstrBot Subagent astr_agent_tool_exec.py _build_handoff_toolset authorization
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component Subagent. The manipulation results in inco…
-
Medium 6.5
phpMyFAQ before 4.1.6 Privilege Escalation via Group Membership
phpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add them…
-
Medium 6.3
AstrBotDevs AstrBot astr_main_agent.py authorization
A vulnerability was identified in AstrBotDevs AstrBot up to 4.25.5. Affected is an unknown function of the file astrbot/core/astr_main_agent.py. The manipulation of the argument req.func_tool leads to incorrect authorization. The attack may be initiated remot…
-
Medium 5.1
Heap pointer corruption via signed/unsigned mismatch in LARGE_TUPLE_EXT decoding in erts external term format decoder
Signed to Unsigned Conversion Error and Out-of-bounds Write vulnerability in Erlang OTP erts allows an attacker who can supply a crafted Erlang external term format (ETF) binary to binary_to_term/1 to corrupt the BEAM heap pointer and crash the virtual machin…
-
Medium 5.2
NULL Pointer Dereference in HDF5 via Invalid Variable-Length Datatype Type Tag
HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.
-
Medium 4.0
Double Free in H5D__chunk_copy() in HDF5 via a Crafted Chunk-Index Size Field
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.
-
Medium 5.5
HDF5 SOHM List Index Heap Buffer Overflow
Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding…
-
Medium 4.8
Relative path traversal in zip:unzip/zip:extract via check_dir_level depth-counter bypass
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks …
-
Medium 6.3
epmd permanent DoS via EMFILE on accept(2) in erts
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion. The do_accept function in erts/epmd/src…
-
Medium 4.8
Path traversal Vulnerability
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users.
-
Medium 5.1
Use of Hard-coded Credentials Vulnerability
Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a hardcoded credential vulnerability in the alarm system. An attacker with access to the cluster with knowledge of the hardcoded credential can read alarm and alert information.
-
Medium 4.8
Exposure of Sensitive System Information to an Unauthorized Control Sphere Vulnerability
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system.
-
Medium 6.5
Mattermost Server Denial of Service via Animated GIF Emoji Upload
Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a c…
-
Medium 4.3
Denial of service via unbounded document content extraction in Mattermost Server
Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade …
-
Medium 6.8
Generation of Error Message Containing Sensitive Information Vulnerability
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.
-
Medium 5.3
WordPress Gillion theme <= 4.13 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Gillion <= 4.13 versions.
-
Medium 4.9
WordPress Easy Digital Downloads plugin <= 3.6.9 - Arbitrary File Deletion vulnerability
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.
-
Medium 5.9
WordPress Checkout Field Editor for WooCommerce – Checkout Manager plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.
-
Medium 4.3
WordPress Insert Headers and Footers Code – HT Script plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.
-
Medium 6.5
WordPress Gallery PhotoBlocks plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.
-
Medium 6.5
WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.
-
Medium 5.4
WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.
-
Medium 4.9
WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.