Archive
17 August 2026
Vulnerabilities first published on this day (UTC), newest first.
344 results · Feed
-
High 7.5
openssl_encrypt before 1.4.0 Insecure Default Configuration
openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS au…
-
Medium 6.5
openssl_encrypt before 1.4.0 CORS Misconfiguration via Wildcard Origins
openssl_encrypt versions before 1.4.0 configure CORS with allow_origins set to wildcard and allow_credentials enabled to true. Attackers can create malicious websites that make authenticated cross-origin requests to the API on behalf of any user who visits th…
-
Critical 9.8
openssl_encrypt before 1.4.0 Token Leakage via Query Parameters
openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access.
-
High 7.5
openssl_encrypt before 1.4.0 Information Disclosure via /ready endpoint
openssl_encrypt versions before 1.4.0 contain an information disclosure vulnerability in the /ready endpoint that returns full database exception strings to unauthenticated callers. Attackers can trigger database errors to extract sensitive information includ…
-
Critical 9.8
openssl_encrypt before 1.4.0 TOTP Rate Limiter Bypass
openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry imm…
-
Critical 9.8
openssl_encrypt before 1.4.0 Unverified Key Bundle Encryption
openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to …
-
High 8.8
openssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key
openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature…
-
Critical 9.8
openssl_encrypt before 1.4.0 Schema Validation Bypass
openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypa…
-
Medium 5.5
openssl_encrypt before 1.4.0 Password Exposure via CLI Argument
openssl_encrypt versions before 1.4.0 expose passwords passed via the --password CLI argument in process listings accessible to all system users. Attackers can read process arguments through ps aux or /proc/[pid]/cmdline to retrieve plaintext passwords and ke…
-
High 7.5
openssl_encrypt before 1.4.0 Weak PRNG Steganography Pixel Selection
openssl_encrypt versions before 1.4.0 use Python's non-cryptographic random module for steganographic pixel selection in the generate_pseudorandom_sequence function. Attackers who know the password can recover the Mersenne Twister state from approximately 624…
-
Critical 9.8
openssl_encrypt before 1.4.0 Arbitrary Code Execution via Whirlpool
openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the…
-
Medium 6.2
openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR
openssl_encrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key d…
-
Low 3.3
openssl_encrypt before 1.4.8 Hardware Pepper Information Disclosure
openssl_encrypt (pip) versions <= 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hs…
-
High 7.7
stoatchat before 0.15.0 Missing Authorization via Subscribe
stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate members and monitor profile updates of private servers without membership. Attackers can subscribe to any …
-
High 7.5
SiYuan before 3.7.4 Brute-Force Authentication via Publish Service
SiYuan versions before 3.7.4 contain an unthrottled brute-force vulnerability in the Publish Service Basic Auth implementation (PublishServiceTransport.RoundTrip() in kernel/server/proxy/publish.go). The Publish Service runs on a separate, unauthenticated-by-…
-
Medium 4.2
SiYuan before 3.7.4 Cross-Site Request Forgery via CheckAuth
SiYuan versions before 3.7.4 contain a cross-site request forgery vulnerability in the session-cookie authentication branch of CheckAuth() that lacks Origin/Referer validation and sets no explicit SameSite attribute on session cookies. Attackers can craft mal…
-
High 8.2
SiYuan 3.7.3 Cross-Site WebSocket Hijacking via network proxy
SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious we…
-
High 8.2
SiYuan before 3.7.4 Local Privilege Escalation via elevator.exe
SiYuan before 3.7.4 fails to properly escape workspace directory paths when constructing command-line arguments for the elevated elevator.exe helper process. Attackers can create a malicious workspace directory with command metacharacters in its path and trig…
-
Critical 9.0
SiYuan before v3.7.4 Stored XSS via assets endpoint
SiYuan before v3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers when serving arbitrary file assets, allowing stored cross-site scripting attacks. Authenticated attackers can upload HTML files as assets and execute scripts with full ke…
-
Critical 9.3
SiYuan before 3.7.4 Unauthenticated Debug Endpoint Information Disclosure
SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets in…
-
High 8.7
SiYuan kernel Path Traversal via database_clean MCP tool
SiYuan kernel before v3.7.4 contains a path traversal vulnerability in the database_clean MCP tool. The tool performs only an empty-string check on the id parameter before passing it to RemoveUnusedAttributeView (kernel/model/attribute_view.go), which builds …
-
Medium 6.3
Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery
A vulnerability was found in Kira-Pgr PromptShopMCP up to 5bc0cd17358e19a5415d11a531088170d7b81452. Affected is the function download_image of the file server.py of the component Image-Toolkit-MCP-Server. Performing a manipulation of the argument image_url re…
-
High 8.8
2100 Technology｜Official Document Management System - Arbitrary File Upload
Official Document Management System developed by 2100 Technology has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.
-
Medium 5.1
Permission control vulnerability in the notification module. Impact: Successful exploitation of this vulnerability may …
-
Medium 6.2
Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affec…
-
Medium 6.2
Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability…
-
Medium 5.5
Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may aff…
-
Low 3.3
UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect av…
-
Medium 6.2
Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerabi…
-
Medium 6.2
Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerabil…
-
Medium 4.0
Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may aff…
-
Medium 4.0
Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may aff…
-
Medium 6.2
Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability …
-
Medium 6.3
itsourcecode Hospital Management System viewprescriptionrecord.php sql injection
A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the att…
-
Medium 6.3
Open Asset Import Library Assimp 3DGS MDL7 Bone Transformation Key MDLLoader.cpp ParseBoneTrafoKeys_3DGS_MDL7 buffer overflow
A security vulnerability has been detected in Open Asset Import Library Assimp Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ParseBoneTrafoKeys_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component 3DGS MDL7 Bone T…
-
Medium 4.3
code-projects Online Shopping System offersmail.php cross site scripting
A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. T…
-
Medium 4.7
Webkul Bagisto Backend Sales RMA Endpoint requests authorization
A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The att…
-
Medium 4.3
Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management
A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege manag…
-
Low 3.5
Webkul Bagisto RMA Message send-message cross site scripting
A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote explo…
-
Critical 9.4
Authenticated Blind SQL Injection in Google Cloud SecOps SOAR Dashboard Widget Query Service
A SQL Injection vulnerability in a legacy dashboard widget API in Google Cloud Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to execute blind SQL queries using a crafted request parameter. Th…