Archive
3 August 2026
Vulnerabilities first published on this day (UTC), newest first.
119 results · Clear filters · Feed
-
High 8.1
OpenEMR 8.2.0 OAuth2 Dynamic Client Registration Unauthorized FHIR Access
OpenEMR through 8.2.0 contains an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint that allows unauthenticated attackers to register a malicious client with system-level FHIR scopes by supplying a self-generated RSA key…
-
High 7.0
CheckMAL AppCheck Pro Kernel Mini-Filter Driver AppCheckD.sys uncontrolled search path
A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mini-Filter Driver. Performing a manipulation results in uncontrolled search path. The attack requires…
-
High 8.8
Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinc…
-
High 7.2
OpenEMR Authenticated SQL Injection via backup.php Import Feature
OpenEMR through 8.2.0 contains an authenticated SQL injection vulnerability in the backup configuration import feature that allows administrators with admin or super ACL privileges to execute arbitrary DDL and DML statements against the application database b…
-
High 8.8
Krayin CRM < 2.2.4 Blind SQL Injection via LeadDataGrid.php rotten_lead Parameter
Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVING clause by manipulating the rotten_lead[in] query parameter, which is concatenate…
-
High 7.5
Apache Jena Fuseki: Web requests using SPARQL Update can escape file restrictions
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users are recommended to upgrade to version 6.2.0, which fixes the issue.
-
High 7.5
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check
XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was skipped before any cryptographic check. verify in lib/XML/Sig.pm counts the `//dsig:Signature` elements into `$numsigs` a…
-
High 7.8
Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sud…
-
High 7.8
Remote Code Execution via Insecure Deserialization in TÜBİTAK BİLGEM's eta-otp-lock
Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.
-
High 7.2
Telenia TVox 26.5.3 OS Command Injection via action_audio.php
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsan…
-
High 8.1
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass via XML signature wrapping because new_from_xml reads assertion identity with document-wide XPath instead of the signed subtree. new_from_xml reads the NameID, attribute values, Session…
-
High 7.0
GitPython before 3.1.53 Config Injection via Submodule Names
GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the…
-
High 8.8
OpenWrt luci-app-dockerman Read ACL Remote Code Execution
OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots containing the ucode docker_rpc.uc RPC backend after the JS/ucode conversion) contains an OS command injection vulnerability. The package's read ACL grants broad ubus access to docker.* / doc…
-
High 7.5
OpenWrt luci-app-bmx7 Path Traversal via bmx7-info
OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply direct…
-
High 7.5
Admidio before 5.0.11 Authentication Bypass via forum.php
Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the login-only configuration state, allowing unauthenticated attacker…
-
High 7.5
Grav CMS before 2.0.11 Path Traversal via watermark
Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformResourceLocator::findResource(). Because the file:// scheme branch only lexically c…
-
High 8.1
Grav CMS 2.0.7 through 2.0.10 Arbitrary Method Invocation via Blueprint
Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives because Blueprint::isSafeDynamicCall() only applies its dangerous-callable denylist to strings that do not contai…
-
High 7.7
SiYuan before v3.7.3 Path Traversal via unvalidated avID
SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anon…
-
High 8.6
SiYuan before v3.7.3 Information Disclosure via getHeading*Transaction
SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous rea…
-
High 8.6
SiYuan before v3.7.3 Content Disclosure via getBacklinkDoc
SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/getBackmentionDoc). While the corresponding backlink list endpoints filter publish-forbidden documen…
-
High 8.6
SiYuan before v3.7.3 Authentication Bypass via Content Endpoints
SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc en…
-
High 8.8
GL.iNet GL-MT3000 Network Lua RPC Plugin network network.switch_status command injection
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch l…
-
High 7.5
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured
Net::SAML2 versions before 0.86 for Perl allow SAML authentication bypass by verifying responses against the response-embedded certificate in verify_xml when no trust anchor is configured. verify_xml in Net::SAML2::Role::VerifyXML runs "return if !$anchors &&…
-
High 8.0
GL.iNet GL-MT3000 Logread Lua RPC Plugin logread logread.set_config command injection
A flaw has been found in GL.iNet GL-MT3000 up to 4.4.5. The impacted element is the function logread.set_config of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC Plugin. This manipulation of the argument record_size causes command in…
-
High 8.8
GL.iNet GL-MT3000 Logread Lua RPC plugin logread logread.get_system_log command injection
A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function logread.get_system_log of the file /usr/lib/oui-httpd/rpc/logread of the component Logread Lua RPC plugin. The manipulation of the argument module results in c…
-
High 7.3
eParakstītājs 3.0 for Windows – remote code execution via unauthenticated auto-update
eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS ce…
-
High 8.8
Cross-Site Request Forgery in the Administrative User Deletion Endpoint
CTI-Transmute contained a cross-site request forgery vulnerability in the administrative user deletion functionality. The /account/delete/<id> endpoint accepted HTTP GET requests for an operation that modified application state. An unauthenticated remote atta…
-
High 8.7
Unauthenticated Denial of Service via Unbounded Activity-Timeline Range in CTI-Transmute
CTI-Transmute contains an uncontrolled resource-consumption vulnerability in the unauthenticated /activity_timeline endpoint. The endpoint accepts a user-controlled days query parameter that was not restricted to a reasonable range. A remote, unauthenticated …
-
High 8.8
Server-Side Request Forgery and Local File Disclosure in CTI-Transmute Evaluation PDF Rendering
CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendere…
-
High 7.5
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional…
-
High 7.5
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional…
-
High 7.5
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional…
-
High 7.5
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional…
-
High 7.5
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional…
-
High 7.5
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional…
-
High 7.5
In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional…
-
High 7.5
In nr modem, there is a possible improper input validation. This could lead to remote denial of service with System exe…
-
High 7.3
An incorrect default permissions vulnerability in Synology Assistant before 7.0.7-50095 allows local users to read or w…
-
High 8.6
LogMyTrip <= 1.9 - Unauthenticated SQL Injection via 'tid' Cookie
The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks on any page that renders one of the LogMyTrip WordPress plugin …
-
High 8.1
SM Page Duplicator <= 1.0.0 - Editor+ SQL Injection via Page Duplication
The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with the Editor role and above to perform SQL Injection attacks.