Archive
July 2026
Vulnerabilities first published in this month (UTC), newest first.
9,908 results · Feed
-
Medium 4.8
CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure()
CodeIgniter is a PHP full-stack web framework. In versions prior to 4.7.4, IncomingRequest::isSecure() trusted the X-Forwarded-Proto and Front-End-Https headers from any incoming request, allowing an attacker could spoof these headers and cause the applicatio…
-
Medium 6.3
Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer wi…
-
High 7.1
Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and app_id values, allowing an OAuth t…
-
Medium 4.3
Cloudreve: Broken access control in file event stream leaks activity events for unshared siblings to single-file share recipients
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient t…
-
Medium 6.5
Cloudreve: Server crash through image decompression/pixel bomb in thumbnail & avatar decoding (DoS)
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the built-in thumbnail and avatar image decoders limit compressed file size but do not limit decoded pixel dimensions, allowing an authenticated user to submit a small PNG, JPEG, …
-
Medium 4.3
Cloudreve: Inactive/banned account emails leaked via GET /api/v4/user/search because SearchActive() omits the active-status predicate
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, GET /api/v4/user/search calls SearchActive without adding a StatusActive predicate and serializes matches at RedactLevelUser, allowing any logged-in user to enumerate email addres…
-
High 7.5
A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achiev…
-
Critical 9.2
A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to ac…
-
Medium 4.3
Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account
Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, the WOPI PUT_RELATIVE handler passes X-WOPI-SuggestedTarget to URI.JoinRaw as a path rather than a filename, allowing slash and dot-dot segments to escape the source file director…
-
Critical 9.2
A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to…
-
High 8.6
A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute …
-
Critical 9.2
A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to ac…
-
High 7.8
Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection
A flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misin…
-
High 8.0
Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider
An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientI…
-
High 8.0
Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox
A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlyin…
-
Medium 6.6
Denial of Service via Unrestricted Payload Buffering in MCP Toolbox
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payl…
-
Medium 5.7
BigQuery Dataset Allowlist Bypass via Metadata Dry-Run in MCP Toolbox
An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relie…
-
High 8.1
Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through leg…
-
Low 3.3CVE-2026-58039 Public exploit
A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-w…
-
Critical 9.8
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters dist…
-
Critical 9.8
SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.
-
High 8.8
PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF). The payment vali…
-
Critical 9.8
Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The f…
-
Critical 9.8
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v…
-
Critical 9.8
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v…
-
Critical 9.8
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v…
-
High 7.2
TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock i…
-
Critical 9.8CVE-2026-52134 Public exploit
An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass a…
-
Medium 6.5
A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authentica…
-
Medium 6.1
A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Buil…
-
Critical 9.8
An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted re…
-
High 7.4
An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authenticatio…
-
Medium 6.5
MZ Automation lib60870 Out-of-bounds Read
A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.
-
Medium 6.5
MZ Automation lib60870 Out-of-bounds Read
A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes InformationObject_ParseObjectAddress to read one byte past the end of the heap-allocated message buffer.
-
Medium 5.4
SFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creation
SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or over…
-
Medium 6.5
MZ Automation libiec61850 Out-of-bounds Read
The GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bo…
-
Medium 6.5
MZ Automation libiec61850 Out-of-bounds Read
The GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position inc…
-
Medium 6.5
MZ Automation libiec61850 Out-of-bounds Read
The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-request messages. When a crafted BER-encoded element is received over an established MMS session (TCP port 102), the decoder may advance its internal re…
-
Medium 6.5
MZ Automation libiec61850 Out-of-bounds Read
The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplied length value is not validated, causing a read past the end of a heap buffer. This leads to termination of the MMS service process and a denial-of-se…
-
Medium 6.5
MZ Automation libiec61850 Out-of-bounds Read
The GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclos…