Archive
3 August 2026
Vulnerabilities first published on this day (UTC), newest first.
10 results · Clear filters · Feed
-
Low 3.1
OpenAkita File Upload API upload cross site scripting
A security flaw has been discovered in OpenAkita up to 1.27.12. This vulnerability affects unknown code of the file /api/upload of the component File Upload API. The manipulation of the argument File results in cross site scripting. The attack may be performe…
-
Low 2.3
Misskey: Lack of proper permission checks in Direct Messaging feature
Misskey is an open source, federated social media platform. Versions 2025.3.2 and later, but prior to 2026.5.4, contain a vulnerability where a lack of proper permission checks allows access to certain data points from the Direct Messages (formerly Chat) feat…
-
Low 2.3
Apache NiFi: Authorization Bypass for Parameter Context Asset Deletion
Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifi…
-
Low 3.7
HCL iControl is affected by multiple security vulnerabilities(CVE-2026-56608 and CVE-2026-56609).
HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization.
-
Low 2.4
Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. The…
-
Low 2.1
Meesho Online Shopping App com.meesho.supply cleartext storage
A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name le…
-
Low 2.7
TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR
The Tag, Category, and Taxonomy Manager WordPress plugin before 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data, allowing users with contributor privileges to disclose data from priv…
-
Low 2.7
Classified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted t…
-
Low 2.7
Classified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts
The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post…
-
Low 3.3
ggml-org llama.cpp Jinja Minja Template parser.cpp assertion
A vulnerability was determined in ggml-org llama.cpp e15efe0. Affected by this issue is some unknown functionality of the file common/jinja/parser.cpp of the component Jinja Minja Template Parser. Executing a manipulation with the input {{9|9|{ can lead to re…