Archive
25 August 2026
Vulnerabilities first published on this day (UTC), newest first.
353 results · Clear filters · Feed
-
Medium 4.7
Kimai before 2.53.0 Open Redirect via RelayState
Kimai before 2.53.0 contains an open redirect vulnerability in the SAML authentication success handler that accepts unvalidated RelayState POST parameters as redirect destinations. Attackers with IdP access can supply malicious RelayState values to redirect a…
-
Medium 4.3
Kimai before 2.57.0 Improper Authorization via Favorite Endpoints
Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's fav…
-
Medium 5.4
Kimai before 2.63.0 Team Membership Removal via API
Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all existing team members before validating the submitted replacement member list. An authenticated tea…
-
Medium 4.3
Kimai before 2.64.0 Missing Authorization via ProjectViewController export
Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route (report_project_view_export). The authorization guards are attached to the sibling __invoke method rather than at the class level, so the export route…
-
Medium 6.5
LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extraction
LeafWiki extracts an uploaded ZIP archive without limiting how much data it will write. ZipExtractor.ExtractToDir in internal/importer/zip_extractor.go opens each entry and copies it to the destination with io.Copy, which runs to the end of the decompressed s…
-
Medium 6.3
Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secret
Doorkeeper is an OAuth 2 provider for Ruby on Rails. In version 1.9.0, an attacker who knows only a dynamically registered client's client_id, which is public information, can authenticate as that client at the token endpoint and obtain an access token withou…
-
Medium 4.2
Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010
Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, from 0.0.0 to 11.2.*.
-
Medium 4.7
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Drupal core versions: from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 1…
-
Medium 5.4
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0…
-
Medium 6.1
Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders versions: from 0.0.0 to 1.0.8.
-
Medium 6.1
Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Search API Autocomplete versions: from 0.0.0 to 1.12.0.
-
Medium 5.7
PanKM - Critical - Unsupported - SA-CONTRIB-2026-083
Vulnerability in Drupal PanKM. This issue affects PanKM versions: *.*.
-
Medium 5.7
Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085
Vulnerability in Drupal Email Login OTP. This issue affects Email Login OTP versions: *.*.
-
Medium 5.7
Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086
Vulnerability in Drupal Lunr exposed filters. This issue affects Lunr exposed filters versions: *.*.
-
Medium 5.7
Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089
Vulnerability in Drupal Development Environment. This issue affects Development Environment versions: *.*.
-
Medium 5.7
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110
Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Disable Login Page allows Brute Force. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
-
Medium 5.7
Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092
Vulnerability in Drupal Powerful Surveys. This issue affects Powerful Surveys versions: *.*.
-
Medium 4.2
Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopes
Doorkeeper OpenID Connect implements an OpenID Connect authentication provider for Rails applications on top of Doorkeeper. Prior to 1.10.4, the Dynamic Client Registration (DCR) endpoint persists client-supplied scopes without validating them against the ser…
-
Medium 6.8
Apache Tomcat: Authenticated WebSocket session survives end of HTTP session
Insufficient Session Expiration vulnerability in Apache Tomcat meant that if the session ID for an authenticated HTTP session was changed after a WebSocket connection had been established under that authenticated HTTP session, the WebSokcet session would not …
-
Medium 5.7
Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root
BlueZ sdp-xml.c type confusion via RegisterProfile(ServiceRecord) can crash bluetoothd (local DoS): a crafted nested ServiceRecord can corrupt the SDP XML parser stack so scalar union data is treated as a sequence pointer, allowing a local caller to crash blu…
-
Medium 6.4
TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain
TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make typebots on that domain unavailable. The custom-domain delete handler in handleDeleteCustomDomain.ts …
-
Medium 5.9
Velero vulnerable to file path traversal when extracting from backup's tarball
Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-…
-
Medium 4.3
code-projects Online Shopping System sumit_form.php cross site scripting
A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit_form.php. Such manipulation of the argument Success leads to cross site scripting. The attack may b…
-
Medium 6.9
MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service
The MCP PHP SDK (Composer package mcp/sdk) is the official Model Context Protocol SDK for PHP. In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer wi…
-
Medium 4.4
Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validation
A flaw was found in the file-xwd plugin in GIMP. When processing a specially crafted XWD image file, the plugin validates the image width and bytes-per-line parameters independently rather than ensuring their combined values are consistent with the allocated …
-
Medium 5.3CVE-2026-77680 Public exploit
Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix
An algorithmic complexity flaw exists in libsoup's HTTP Range header processing that persists after the CVE-2025-32907 fix. CVE-2025-32907 addressed memory amplification when a client repeated the same range many times in a single Range header. Commit 9bb92f7…
-
Medium 6.5
ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumption
ORAS (OCI Registry As Storage) is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cycli…
-
Medium 5.6
zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injection
A flaw has been found in zackees transcribe-anything up to 4.1.0. Affected is the function ytdlp_download of the file src/transcribe_anything/ytldp_download.py of the component Yt-dlp Download. This manipulation of the argument url causes os command injection…
-
Medium 5.5
NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive in…
-
Medium 5.6
NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials . A success…
-
Medium 6.8
NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS co…
-
Medium 5.2
NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper e…
-
Medium 6.5
Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker le…
-
Medium 5.9
Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed a…
-
Medium 4.3
Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote att…
-
Medium 6.5
Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromi…
-
Medium 6.5
Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read me…
-
Medium 6.5
Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak se…
-
Medium 6.5
Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive …
-
Medium 5.5
Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensiti…