Archive
11 August 2026
Vulnerabilities first published on this day (UTC), newest first.
345 results · Clear filters · Feed
-
Medium 5.3
n8n before 1.123.67 SQL Injection via executeQuery Operation
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the Snowflake node's Execute Query operation, which interpolates expression values directly into the SQL string. When a workflow author embeds untrusted, externally-controlled e…
-
Medium 6.2CVE-2026-72744 Public exploit
Nuxt before 4.5.1 Information Disclosure via Chrome DevTools
Nuxt versions >= 4.4.7 and < 4.5.1, and >= 3.21.7 and < 3.21.10, contain an information disclosure vulnerability in the development server's Chrome DevTools workspace endpoint (GET /.well-known/appspecific/com.chrome.devtools.json). The endpoint's local-reque…
-
Medium 4.3
Koha Community Koha - Stored SQL Injection via Patron lang Field in Issue Slip Generation
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers permission to cause a time-based denial of service by storing a SQL payload in a patron lang field.…
-
Medium 6.5
Koha Community Koha - Stored SQL Injection via Patron Card Layout image_name
A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permission to execute arbitrary SQL via the image_name field of a patron card layout. The image_name val…
-
Medium 6.5
Intelliants Subrion CMS - Path Traversal
A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink() …
-
Medium 6.5
Apioo Fusio - Server-Side Request Forgery
A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration …
-
Medium 6.5
Friendica Friendica - Server-Side Request Forgery
A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL…
-
Medium 6.5
HumanSignal Label Studio - Server-Side Request Forgery
A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses o…
-
Medium 5.4
Daniel Brendel HortusFox - Cross-Site Scripting
A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedown rendered without safe mode. Notes are rendered unescaped in the browser of every user who views …
-
Medium 6.5
Ladybird Web Solution Faveo Helpdesk - Broken Access Control
A broken access control vulnerability in Ladybird Web Solution Faveo Helpdesk 2.0.3 allows any self-registered customer to read ticket conversations belonging to other customers via the v1 REST API. The API verifies the existence of the requested ticket but n…
-
Medium 5.4
ElkArte Forum ElkArte - Cross-Site Scripting
A stored cross-site scripting vulnerability in ElkArte Forum 2.0 Beta 1 allows any registered member to inject persistent JavaScript into the profile fields cust_blurb and cust_locate. The fields are saved without HTML encoding and rendered unescaped in profi…
-
Medium 5.3
OpenSignLabs OpenSign - Information Disclosure
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authent…
-
Medium 5.4
Windmill Labs Windmill - Missing Authorization
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization ex…
-
Medium 6.5
Windmill Labs Windmill - Missing Authorization
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that t…
-
Medium 6.5
Windmill Labs Windmill - Information Disclosure
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforceme…
-
Medium 6.0
Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive nam…
-
Medium 5.2
Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0
The Windows installer deployed Npcap leaving its access restriction option at the insecure default value, so the driver was accessible to every local user of the host instead of being restricted to administrators only. A local user without administrative priv…
-
Medium 5.3
cti-transmute CSRF Allows Unauthorized Follow and Notification State Changes
Affected versions of MISP cti-transmute expose several state-changing account operations as GET requests: * /account/follow * /account/delete_notification * /account/mark_notification_read * /account/mark_all_read These endpoints require authentication, but b…
-
Medium 5.1
cti-transmute Conversion Table Allows XSS via Unescaped Cell Content During Search Highlighting
Affected versions of cti-transmute improperly handle conversion-table values passed through the search highlighting feature. The highlight() function previously returned the underlying text directly when no search query was supplied, or performed a regex repl…
-
Medium 5.3
Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion
A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive …
-
Medium 5.1
cti-transmute Stored XSS via Crafted Tag Icon on Admin Triage Interface
Affected versions of cti-transmute allow a tag's icon value to be stored and later interpolated into HTML through Vue's v-html. The helper mapIcon() previously constructed an HTML string directly from the icon value: <i class="fas fa-${name}"></i> Because the…
-
Medium 5.1
cti-transmute Saved Graph Configuration Allows Stored Cross-Site Scripting via svgIcon
Affected versions of cti-transmute insufficiently validate saved graph configuration data. Graph configurations can contain style properties that are later consumed by Pivotick, and Pivotick interprets svgIcon as HTML. Because saved configurations may be crea…
-
Medium 4.3
Claircore: claircore: denial of service via unchecked type assertion in rpm header parser
A flaw was found in claircore's RPM package scanner. Crafted RPM header data in a container layer can cause an unchecked type assertion to panic the scanner. The panic is not recovered, causing the Clair indexer process to crash, leading to a denial of servic…
-
Medium 5.3
cti-transmute Sunburst and Treemap Tooltips Allow Cross-Site Scripting via Crafted Conversion Data
Affected versions of cti-transmute fail to HTML-escape attacker-controlled values used in ECharts Sunburst and Treemap tooltip formatters. Slice names may originate directly from STIX or MISP data, including STIX types, relationship_type, pattern prefixes, an…
-
Medium 5.3
cti-transmute Missing Authorization Allows Reactions to Private Comments
Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are authorized to view the target comment. The vulnerable react() handler passed an attacker-controlled commen…
-
Medium 5.3
cti-transmute Evaluation Report Exports Expose Private Comments and Author Information
Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieval filters comments according to conversion visibility, comment privacy, ownership, authorship, and a…
-
Medium 6.5
Improper Validation of Specified Quantity in Input vulnerability in Samsung Open Source rlottie allows Input Data Manip…
-
Medium 6.5
Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives
A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be include…
-
Medium 6.5
Improper Validation of Specified Quantity in Input and Allocation of Resources Without Limits or Throttling vulnerabili…
-
Medium 6.5
Ray Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token w…
-
Medium 4.3
Ray Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion
The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages.
-
Medium 5.2
Out-of-bounds write in USB CDC NCM control handler when host wLength is smaller than the response
The USB device-side CDC NCM class control-to-host handler usbd_cdc_ncm_cth in subsys/usb/device_next/class/usbd_cdc_ncm.c builds a fixed-size response for the GET_NTB_PARAMETERS (28-byte struct ntb_parameters) and GET_NTB_INPUT_SIZE (8-byte struct ntb_input_s…
-
Medium 5.1
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to pri…
-
Medium 5.7
An ACAP configuration file lacks input validation, which could potentially lead to privilege escalation. This vulnerabi…
-
Medium 5.7
The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to pri…
-
Medium 5.3
The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to …
-
Medium 5.9
The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited afte…
-
Medium 4.1
Velociraptor NETWORK ACL bypass via upload_azure / upload_sftp / upload_smb VQL plugins
Missing authorization check in the upload_azure, upload_sftp, and upload_smb VQL plugins allows an authenticated analyst-role user can initiate attacker-controlled outbound network connections from the Velociraptor server, bypassing the NETWORK ACL permission…
-
Medium 4.6
NULL pointer dereference in USB DFU device_next download handler (handle_download)
The USB DFU class implementation in Zephyr's new (experimental) device_next USB device stack contains a NULL pointer dereference in handle_download() (subsys/usb/device_next/class/usbd_dfu.c). The handler computes MIN(setup->wLength, buf->len) and passes buf-…
-
Medium 5.9
Double-free / use-after-free in Realtek BEE Bluetooth HCI driver `send()` error paths
The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api buffer-ownership contract. That contract requires the driver to consume (unref) the transmit net_buf only on success; on…