Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
4,085 results · Clear filters · Feed
-
Medium 6.5
Incorrect privilege assignment in the Amazon aws-athena-query-federation ClickHouse connector deployment template
Incorrect privilege assignment in the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1 could allow an authenticated remote user to read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the…
-
Medium 5.8
Appwrite Templates github-issue-bot Skips Webhook Signature Verification When the X-Hub-Signature-256 Header Is Absent
The github-issue-bot templates in appwrite/templates verify the GitHub webhook signature with an inverted condition. verifyWebhook in node/github-issue-bot/src/github.js and in node-typescript/github-issue-bot/src/github.ts returns "typeof signature !== 'stri…
-
Medium 5.3
An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single …
-
Medium 4.3
A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of wh…
-
Medium 6.5
Wagtail: Improper restriction handling on Page translation API endpoint
### Impact A CMS user with the "submit translations" permission, could use the Admin API's "copy for translation" endpoint to copy an existing page that they do not have edit access to, allowing them to view its contents. ### Patches Patched versions have bee…
-
Medium 6.5
Wagtail: Improper permission handling when copying snippets
### Impact A CMS user with "add" permission over a snippet model, but not "change" or "view" permission, could copy an existing snippet that they do not have access to, allowing them to view its contents. ### Patches Patched versions have been released as Wag…
-
Medium 5.3
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
### Impact The Documents and Images [API V2](https://docs.wagtail.org/en/stable/advanced_topics/api/index.html) incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with …
-
Medium 4.5
Winter: Reflected XSS through the search query parameter in the backend Table widget
### Impact Affected versions of Winter CMS render the `search` query parameter without HTML encoding inside a `<script type="text/template">` block in the backend Table widget partial (`modules/backend/widgets/table/partials/_table.php`): ```php value="<?= ge…
-
Medium 6.1
Winter: CSRF through AJAX handler names reachable as backend page actions
### Impact Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level `GET` navigation with no CSRF token. `Backend\Classes\Controller::actionExists()` accepted any public method on a controller as a page action, so handle…
-
Medium 4.5
Winter: Stored XSS through cached Brand Settings and Editor Settings custom styles
### Impact Users with the `backend.manage_branding` ("Customize the back-end") or `backend.manage_editor` ("Manage global code editor preferences") permission can provide custom CSS through **Settings → Customize Backend → Styles** or **Settings → Editor Sett…
-
Medium 4.3
Winter: My Account preview exposes another backend user's profile by record ID
### Impact `Backend\Controllers\MyAccount`, introduced in v1.2.13, declares an empty `$requiredPermissions` array so that any authenticated backend user can manage their own account. It implements the `FormController` behavior, which exposes three routable ac…
-
Medium 5.3
netty-incubator-codec-ohttp: Binary HTTP parser unchecked varint length overflow causes decoder crash
## Summary `io.netty.incubator:netty-incubator-codec-bhttp` uses attacker-controlled Binary HTTP variable-length integers as `long` values but accumulates them into `int` offsets. Large valid varint lengths wrap the internal offset negative, leading to unchec…
-
Medium 6.5
libgit2: HTTP transport can leak credentials to an offsite redirect target
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, the built-in HTTP transport in src/libgit2/transports/http.c f…
-
Medium 6.5
libgit2: Inverted IP SubjectAltName Comparison in OpenSSL Backend
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, verify_server_cert in src/libgit2/streams/openssl.c uses an in…
-
Medium 5.3
libgit2: Unbounded Memory Allocation via Delta Object Result-Size Header
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, git_delta_apply in src/libgit2/delta.c trusts the attacker-con…
-
Medium 4.3
libgit2: Submodule path traversal
libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Prior to 1.8.6 and 1.9.5, libgit2 does not reject traversal components in a submodule pa…
-
Medium —
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
A race condition in kcl-lib can result in a use-after-free when accessing environments concurrently. During Vec reallocation, the previous buffer containing Box pointers is freed and replaced. A concurrent get_env operation that has already loaded a pointer t…
-
Medium —
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
### Impact Feeding a KCL program that wraps an expression in deep, unnecessary parentheses triggers the parser’s recursive `expression` -> `unnecessarily_bracketed` -> `expression` path. With enough nesting, the call stack grows until it exceeds the process s…
-
Medium 6.3
Unencrypted Credential Transmission in Omada Gateway Dynamic DNS Authentication in Omada Gateways
A vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate t…
-
Medium 6.0
Unauthenticated Captive Portal Session Termination and Forced Logout in Omada Gateways
An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate t…
-
Medium 5.9
BunkerWeb: rDNS bypass via missing forward-confirmation (FCrDNS) in blacklist, greylist, and antibot
BunkerWeb is an open-source, next-generation Web Application Firewall. Prior to 1.6.13, the blacklist, greylist, and antibot modules in src/common/core/blacklist/blacklist.lua, src/common/core/greylist/greylist.lua, and src/common/core/antibot/antibot.lua tru…
-
Medium 6.9
Frappe: User Enumeration via PDDR
Frappe is a full-stack web application framework. Prior to 15.115.0 and 16.27.0, the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py return distingui…
-
Medium 6.9
Frappe: Unauthenticated Workflow approval via confirm_action
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the end…
-
Medium 5.3
msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation
msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own…
-
Medium 5.7
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable
Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public", with no means of overriding it. This advises proxies that the content may be store…
-
Medium 5.3
Frappe: Missing authorization in toggle_like and mark_as_seen
Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py and frappe/desk/doctype/note/note.py do not enforce read permission before modifying _liked_by meta…
-
Medium 4.4
django CMS: Stored XSS in edit-mode plugin exception rendering
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.re…
-
Medium 6.5
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePageForm.source accepts …
-
Medium 4.3
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active staff user without cms.…
-
Medium 6.5
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copy_plugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The _copy_plugin_to_clipboard and…
-
Medium 6.5
django CMS: Structure endpoint bypasses page-view permission
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling user_can_view_page(…
-
Medium 4.8
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key function includes the cache…
-
Medium 6.3
Libevent: HTTP Header smuggling
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trai…
-
Medium 5.7
Libevent: Null Pointer Dereference in `evws_new_session`
Libevent is an event notification library. Prior to 2.2.2-alpha, libevent can dereference invalid list pointers in ws.c when evws_new_session enters its error path after evhttp_start_ws_ succeeds but bufferevent_enable_locking_ fails. evws_connection_free see…
-
Medium 5.8
Libevent: Dangling Pointer in `evbuffer_add_buffer_reference`
Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has a use-after-free in buffer.c when evbuffer_add_buffer_reference processes an output buffer whose out_total_len is zero. evbuffer_free_all_chains frees the initial empty c…
-
Medium 6.5
Mongoose: Path traversal in SSI #include directives enables arbitrary file read
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can control an SSI-enabled file can place directory traversal sequences in an #include file or #include virtual directive. The mg_ssi() function in src/ssi.c concatenates t…
-
Medium 5.4
Mongoose: Reflected XSS via decoded URI in directory listing render
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src…
-
Medium 5.4
Mongoose: Stored XSS via unescaped filenames in directory listing
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG_ENABLE_DIRLIST. The printdirentry(…
-
Medium 6.5
Mongoose: Multipart boundary/header scan logic error in mg_http_next_multipart
Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and…
-
Medium 6.3
elunez eladmin GenConfigController improper authorization
A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The …