Archive
27 August 2026
Vulnerabilities first published on this day (UTC), newest first.
159 results · Clear filters · Feed
-
Medium 4.6
openssl_encrypt before 1.4.9 False Encryption via Cleartext Storage
openssl_encrypt (pip package openssl-encrypt) versions <= 1.4.8 advertise a portable USB workspace as an 'Encrypted USB Workspace' with AES-256-GCM encryption and write a marker declaring the workspace encrypted, but the workspace directory is actually stored…
-
Medium 4.0
openssl_encrypt before 1.4.9 Authentication Bypass via Recovery Slot Removal
openssl_encrypt versions before 1.4.9 fail to authenticate recovery-slot presence in envelope-format encrypted files, allowing attackers to remove recovery slots without re-encrypting the payload. Attackers can modify the file header to delete recovery-slot f…
-
Medium 5.3
OpenFaaS Gateway 0.27.11 through 0.27.13 Missing Authentication on the /system/telemetry Route
The OpenFaaS gateway registers GET /system/telemetry in gateway/main.go and, when basic_auth is enabled, wraps each administrative /system/* handler in auth.DecorateWithBasicAuth. TelemetryHandler was left out of that wrap block from 0.27.11, which introduced…
-
Medium 6.1
darknet through 6.0 Out-of-Bounds Read and Write via Unchecked Layer Index in .cfg Parser
darknet subscripts its layer array with an index taken from a configuration file without checking it against the array's length. The array is allocated in src-lib/darknet_network.cpp as xcalloc(net.n, sizeof(Darknet::Layer)), sized to exactly the number of la…
-
Medium 6.5
Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint
The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.…
-
Medium 6.8
Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List
tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a re…
-
Medium 6.8
Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List
tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a reques…
-
Medium 6.8
Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List
pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request wha…
-
Medium 6.8
mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding
mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the hos…
-
Medium 5.9
FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage
FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their …
-
Medium 6.5
FrontAccounting through 2.4.20 Cross-Site Request Forgery on Financial Transaction Forms
FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() t…
-
Medium 4.3
Fonoster through 0.22.7 Incorrect Authorization in the Identity UpdateWorkspace Handler
The updateWorkspace handler in mods/identity/src/workspaces/createUpdateWorkspace.ts in Fonoster through 0.22.7 invokes the gRPC callback with PERMISSION_DENIED when createIsWorkspaceMember reports that the caller is not a member of the target workspace, but …
-
Medium 5.3
APITable through 1.13.0-beta.1 Missing Authentication on the Internal Notification Create Endpoint
APITable through 1.13.0-beta.1 annotates the create handler of InternalNotifyController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the pro…
-
Medium 5.2
T2000 open debug port
Debug and Test Interface With Improper Access Control vulnerability in Johnson Controls T2000 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects T2000: before 31.6.
-
Medium 4.0
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::MessageEncoder wrote a DNS label's length…
-
Medium 5.3
User Enumeration in Seres Software's syWEB
Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported.
-
Medium 6.1
Reflected XSS in Seres Software's syWEB
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is …
-
Medium 6.9
Flowintel Login Email Validation Bypass Allows Log Injection via Crafted Email Input
Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input co…
-
Medium 5.1
Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes
Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; * attribute value; * attribute type; * comment; * first/last seen values; * IDS flag. Those values were concatenated d…
-
Medium 6.0
In Eclipse SW360 versions 19.0.0, 19.1.0, 19.2.0, 20.0.0, 20.1.0, if the system is configured to use file system storag…
-
Medium 4.6
Formula Injection in dool project
Dool in versions up to 1.3.8 is vulnerable to a CSV injection vulnerability when exporting data to a CSV file, as it fails to sanitize cell content beginning with special formula characters like =, +, -, or @. A local attacker can exploit this by running a pr…
-
Medium 5.3
Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments
Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general…
-
Medium 6.1
Reflected XSS in BilPark's DoXBASE
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in BilPark Informatics Technologies Industry and Trade Inc. DoXBASE allows Cross Zone Scripting. This issue affects DoXBASE: through 27082026. NOTE: The vendor…
-
Medium 6.5
Volmarg Personal Management System Path Traversal via get-file Endpoint
Volmarg Personal Management System contains a path traversal vulnerability that allows authenticated attackers to read arbitrary files by supplying absolute filesystem paths to the GET /public/get-file/{path} endpoint. The path route parameter is passed direc…
-
Medium 6.4
HCL IntelliOps Event Management is affected by multiple security vulnerabilities.
HCL IntelliOps Event Management (IEM) is affected by a Session Deletion Vulnerability. It may allow improper handling of user sessions, resulting in sessions not being fully terminated after logout or deletion.
-
Medium 5.1
Flowintel Stored XSS in Calendar via Malicious Case Title
Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify a case title could store HTML or script-capable content that is later interpreted by the browser wh…
-
Medium 5.1
Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content
Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Mermaid note content is persisted and later rendered for other users, an attacker with permission to crea…
-
Medium 5.3
AlexGladkov claude-in-mobile client.ts execSync os command injection
A security flaw has been discovered in AlexGladkov claude-in-mobile 3.10.2. This affects the function execSync of the file src/adb/client.ts. Performing a manipulation results in os command injection. The attack requires a local approach. The exploit has been…
-
Medium 5.4
Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and mo…
-
Medium 4.3
HTML Injection in Softtr's E-Commerce Pack
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Softtr Informatics Technology Trading Limited Company E-Commerce Pack allows Cross-Site Scripting (XSS). This issue affects E-Commerce Pack: before 5.03.01.49.
-
Medium 6.5
IDOR in Zirve Security's AdisyonPro
Authorization bypass through User-Controlled key vulnerability in Summit Security Systems AdisyonPro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AdisyonPro: before v5.21.0.
-
Medium 5.3
blackms aistack Static File server.ts path traversal
A vulnerability was identified in blackms aistack up to 1.6.1. Affected by this issue is some unknown functionality of the file src/web/server.ts of the component Static File Handler. Such manipulation of the argument req.url leads to path traversal. The atta…
-
Medium 6.5
Foreman: cross-tenant disclosure of template revisions via unauthorized audit lookup
A flaw was found in Foreman. The template revision endpoint does not enforce object-level authorization when retrieving an audited template revision. An authenticated, low privileged user with a template-related permission, such as view_ptables, can obtain hi…
-
Medium 5.3
WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.
-
Medium 5.3
WordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.
-
Medium 4.9
WordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability
Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.
-
Medium 6.8
WordPress Fluent Boards Pro plugin <= 2.0.11 - Arbitrary File Deletion vulnerability
Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.
-
Medium 6.5
WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
-
Medium 5.4
WordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
-
Medium 6.1
Spring Authorization Server: Open Redirect via request_uri parameter
In versions of Spring Authorization Server 1.5.0 through 1.5.7, the authorization endpoint performs insufficient validation of the request_uri parameter. An attacker can craft a request containing an invalid request_uri paired with an unvalidated redirect_uri…