Archive
7 August 2026
Vulnerabilities first published on this day (UTC), newest first.
11 results · Clear filters · Feed
-
Low 3.6
Use-after-free race in kernel `k_queue_peek_head/tail` due to missing spinlock
The kernel queue helper z_queue_node_peek() in kernel/queue.c dereferences a node taken from a queue's data_q list, reading the node's flag byte and, for items enqueued via k_queue_alloc_append/alloc_prepend, the data pointer of an internally allocated alloc_…
-
Low 3.3
HKUDS nanobot Login-shell Environment shell.py ExecTool._prepare_command information disclosure
A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disc…
-
Low 2.5
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files
File::Rotate::Simple versions before 0.4.0 for Perl create the target of dangling symlinks when rotating files. When the file to be rotated is a symbolic link to a missing file, and the touch option is enabled, then the rotate method assumes that the file is …
-
Low 3.7
Hono: Proxy Helper does not remove response headers listed in the `Connection` header
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.7.0 to 4.12.33, the Proxy Helper proxy() function in hono/proxy does not remove response headers named by the origin's Connection header. Per RFC 9110 Section 7.6.1, …
-
Low 2.3
Frappe: Unrestricted access to Document Follow APIs
Frappe is a full-stack web application framework. Prior to 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receivin…
-
Low 3.5
SourceCodester Photo Share Website Comment Input Box ajax.php save_upload cross site scripting
A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. …
-
Low 3.5
SourceCodester Photo Share Website index.php home cross site scripting
A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. …
-
Low 3.7
WonderTrader TraderDD.cpp queryTrades behavioral workflow
A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulation of the argument FID_JYLB results in enforcement of behavioral workflow. The attack can be launched…
-
Low 2.4
PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting
A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack…
-
Low 2.3
Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection
An injection vulnerability was found in libvirt's virtual network driver. The network XML parser does not strip newline characters from DNS TXT record value attributes and SRV record domain/target attributes. These values are written verbatim into the dnsmasq…
-
Low 2.4
Root password hash exposure vulnerability in ZTE F689 product
The root password hash of the device can be obtained through unencrypted information in the firmware.