Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
4,085 results · Clear filters · Feed
-
Medium 6.3
Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Aut…
-
Medium 6.8
Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). Supported vers…
-
Medium 4.4
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). Suppo…
-
Medium 6.5
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). The …
-
Medium 6.8
Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). Supp…
-
Medium 6.5
Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Worklist). Supported versions that …
-
Medium 6.5
Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Repository). The suppor…
-
Medium 6.5
Out-of-bounds read in Zephyr PTP message parsing from unvalidated message type
Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp_msg_type() (msg->header.type_major_sdo_id & 0xF, range 0-15) and uses it to index the msg_size[] table.…
-
Medium 6.5
Broken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel
The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate() in kernel/thread.c. Its default switch branch is the access-denied path, taken when k_object_valida…
-
Medium 5.1
Blueprint Studio terminal command working directory not bounded to config directory
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, the legacy stateless terminal command execution path in custom_components/blueprint_studio/backend/terminal_manager.py accepted a cwd working-directory para…
-
Medium 5.6
Blueprint Studio terminal SSH private key written to disk
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private-key material to a file …
-
Medium 6.9
Blueprint Studio stored Git credentials in plaintext Git credential store
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens i…
-
Medium 5.3
Blueprint Studio API exposed internal exception details
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio backend API handlers in custom_components/blueprint_studio/backend/api.py returned raw exception strings to authenticated Home Assistant us…
-
Medium 4.3
Information leak in Skia in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to potentially bypass web o…
-
Medium 6.5
Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker…
-
Medium 4.2
Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had comprom…
-
Medium 6.1
fastify vulnerable to X-Forwarded-* spoofing under trustProxy hop-count
fastify is a fast and low overhead web framework for Node.js. Impact: the fix for CVE-2026-3635 added a guard on the forwarded-header reads used to derive the request host, protocol, hostname, ip, and ips values, checking the connecting address. That guard cl…
-
Medium —
Triton VM Soundness Vulnerability due to Missing Constraint
The instruction `sponge_absorb_mem` Triton VM fails to verify that hashed values come from the claimed memory location. Malicious provers can substitute arbitrary data instead of actual memory contents. Any application using instruction `sponge_absorb_mem` to…
-
Medium 5.4CVE-2026-18504 Public exploit
fastify vulnerable to schema validation bypass via root primitive coercion mismatch
fastify is a fast and low overhead web framework for Node.js. Versions of fastify before 5.12.1 are affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an in…
-
Medium 6.5
Froxlor: CSRF Vulnerability in Froxlor AJAX Endpoint — Missing Cross-Site Request Forgery Protection
Froxlor is open source server administration software. Prior to 2.3.8, the standalone lib/ajax.php entry point bypasses the centralized request validation in lib/init.php, and Ajax::handle in lib/Froxlor/Ajax/Ajax.php checks only for a valid session before ro…
-
Medium 5.4
Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields
Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or…
-
Medium 6.0
FUXA: SSRF hardening for `device-webapi-request`
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUX…
-
Medium 6.9
FUXA: Unauthenticated Socket.IO read events
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, hos…
-
Medium 6.3
FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authent…
-
Medium 5.3
FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote …
-
Medium 4.3
Pydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler
Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.go reads the workspace UUID from the path, calls LinkById, and writes the result with no authorizatio…
-
Medium 6.0
Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain an Improper Link Resolution Before File Acce…
-
Medium 6.4
Stack buffer overflow and off-by-one writes in Zephyr HL7800 modem AT response handlers
The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier) parses AT responses with roughly twenty handlers that call net_buf_linearize(value, sizeof(value), *buf, 0, le…
-
Medium 5.3
ZEBRA: Mempool transaction admission denial via single-peer inbound queue saturation
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in Zebra's inbound mempool download and verification pipeline. In zebrad/src/components/mempool/downloads.rs, the …
-
Medium 6.5
ZEBRA: Full node denial of service via non-ASCII LongPollId in getblocktemplate
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an attacker authenticated to an enabled Zebra RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId containing multi-byte UTF-8 characters. In zebra-rpc/src/methods/types/l…
-
Medium 6.5
ZEBRA: Persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a natural or attacker-influenced chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. In zebra-state/src/service/non_finalized_state/chain.rs, Chain::pop_t…
-
Medium 6.9
ZEBRA: Finalized address balance credit-first overflow on consensus-valid blocks
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes. In zebra-state/src/service/finalized_state/zebra_db/transparent.rs, the…
-
Medium 5.9
ZEBRA: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious block producer can terminate zebrad by placing the same shielded transaction in a non-finalized parent block and its child. In zebra-state/src/service/non_finalized_state/chain.rs, Ch…
-
Medium 5.3
ZEBRA: Unbounded memory leak in mempool download pipeline via timeout path cancel_handles retention
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions after verification reaches the outer RATE_LIMIT_DELAY timeout. In zebrad/src/components/mempool/download…
-
Medium 5.3
ZEBRA: Sync restart poisoning from single unauthenticated peer via above-lookahead block
ZEBRA is a Zcash node written entirely in Rust. Prior to 4.5.0, a malicious unauthenticated P2P peer can answer Zebra's outbound getblocks or FindBlocks request with a small two-hash inventory and then serve a syntactically valid block whose coinbase height i…
-
Medium 6.3
xianrendzw EasyReport Move Operations ModuleController.java sql injection
A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522_Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath l…
-
Medium 6.5
Improper handling of highly compressed data (data amplification) in CISA Malcolm
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file …
-
Medium 5.3
Plainpad Missing Rate Limiting via POST /v1/sessions
Plainpad through 1.1.1, fixed in commit d3823fc, contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint due to dead code in App\Http\Kernel.php that is never inst…
-
Medium 4.3
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branch for POST /api/1/certificates//export. A plugin declaring requires_key false bypassed that check, a…
-
Medium 5.4
Incorrect Authorization in CISA Malcolm
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded …