Archive
20 August 2026
Vulnerabilities first published on this day (UTC), newest first.
165 results · Clear filters · Feed
-
Medium 6.5
WeGIA < 3.9.2 Insecure Direct Object Reference via profile_funcionario.php
WeGIA before 3.9.2 contains an insecure direct object reference vulnerability in the employee profile page that allows authenticated attackers to access arbitrary employee records by injecting an id_pessoa parameter through a request extraction function that …
-
Medium 5.3
liftoff-sr CIPster TCP Encapsulation Receive Path encap.cc out-of-bounds
A security vulnerability has been detected in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This impacts an unknown function of the file source/src/enet_encap/encap.cc of the component TCP Encapsulation Receive Path. The manipulation leads to o…
-
Medium 5.3
liftoff-sr CIPster ForwardOpen cipconnectionmanager.cc forward_open out-of-bounds
A weakness has been identified in liftoff-sr CIPster 1802525be27d33e19a9a83c163e331a1d13b1892. This affects the function CipConnMgrClass::forward_open of the file cipconnectionmanager.cc of the component ForwardOpen Handler. Executing a manipulation of the ar…
-
Medium 5.3
WordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8.
-
Medium 4.8
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation.
-
Medium 6.6
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges.
-
Medium 5.9
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior.
-
Medium 5.0
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident respo…
-
Medium 5.4
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing.
-
Medium 6.5
WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in WP BASE Booking <= 6.3.2 versions.
-
Medium 6.5
WordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
-
Medium 6.5
WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.39 versions.
-
Medium 5.9
WordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions.
-
Medium 6.6
WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
Author Local File Inclusion in WP Cafe Pro < 3.0.15 versions.
-
Medium 6.5
WordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Altair <= 5.2.2 versions.
-
Medium 6.3
n8n before 2.34.1 SSRF Protection Bypass via SearXNG Tool
n8n before 2.34.1 and 2.33.x before 2.33.4 contains an SSRF protection bypass in the SearXNG Agent tool. The tool sent requests to the user-supplied API URL using a raw HTTP client that did not route through n8n's centralized SSRF protection. On instances wit…
-
Medium 6.0
n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution
n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to…
-
Medium 5.3
n8n before 1.123.69 ReDoS via Filter and Switch Node
n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously …
-
Medium 5.1
n8n before 1.123.69 Allowed-Domains Bypass via GraphQL Node
n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if tw…
-
Medium 5.3
n8n before 2.34.1 Cross-Project Credential Access via MCP
n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unautho…
-
Medium 6.0
n8n before 1.123.69 SSRF via Edit Image Node
n8n versions before 1.123.69 contain a server-side request forgery vulnerability in the Edit Image node's Draw Text operation that allows authenticated users to inject MVG primitives. Attackers can craft malicious text values to issue blind outbound HTTP requ…
-
Medium 5.0
Omnivore Stored Server-Side Request Forgery via the setWebhook Mutation
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.t…
-
Medium 5.0
Omnivore Server-Side Request Forgery via the scanFeeds GraphQL Query
The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects priva…
-
Medium 6.5
Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value
A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for…
-
Medium 6.9
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5
Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5 - CAPTCHA and field validation bypass.
-
Medium 4.3
Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding
A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU …
-
Medium 6.9
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65
Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.
-
Medium 5.3
Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses
A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes …
-
Medium 4.3
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control
A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php.
-
Medium 6.5
Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access control
A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application.
-
Medium 5.3CVE-2026-76569 Public exploit
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4
-
Medium 5.3CVE-2026-76565 Public exploit
Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7
Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7
-
Medium 5.3
Weak File Name Generation in vsDesk
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully …
-
Medium 6.1
F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected…
-
Medium 6.8
Kirki < 6.2.3 - Editor+ Stored XSS via Font Zip Upload
The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web acc…
-
Medium 6.6
Royal Elementor Addons < 1.7.1066 - Admin+ Remote Code Execution via Widget Builder
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manage_options capability (and, on WordPress Multisite, non-super subs…
-
Medium 6.8
Admin and Site Enhancements < 9.0.1 - Author+ Stored XSS via SVG Upload over XML-RPC
The Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then e…
-
Medium 6.8CVE-2026-19697 Scanner template
GutenKit < 2.5.0 - Author+ Stored XSS via SVG Upload
The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks ag…
-
Medium 5.3
AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint
The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unau…
-
Medium 4.9
libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks. Thus, a use-after-free can occu…