Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
4,085 results · Clear filters · Feed
-
Medium 6.8
WhatsUp Gold versions prior to 26.0.2 excessive file system permissions allows a privileged attacker to write arbitrary files to a web-accessible location on the host server.
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server.
-
Medium 5.4
Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection
Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing a…
-
Medium 6.8
WhatsUp Gold versions prior to 26.0.2 contain an arbitrary file write vulnerability in the LogToFile action handler.
In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root.
-
Medium 4.3
WhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.
In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.
-
Medium 4.3
Potential unauthorized metadata exposure in JFrog Artifactory
An authenticated user without repository read permission may access package metadata under specific conditions.
-
Medium 6.7
Rendered Artifactory Helm manifests may contain generated TLS private keys
Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.
-
Medium 5.3
Authenticated users may write data outside the intended Docker cache path
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
KEV Aug 27, 2026 -
Medium 6.5
Authenticated users may access restricted Artifactory support information
A low-privileged authenticated user may access restricted support information under specific conditions.
-
Medium 6.6
Potential insecure deserialization in JFrog Artifactory
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.
-
Medium 4.3
Authenticated users may write files outside the intended Artifactory work directory
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
-
Medium 5.3
Repository readers may access content outside configured upstream paths
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
-
Medium 5.3
Potential remember-me authentication bypass in JFrog Artifactory
An unauthenticated user may bypass authentication under specific cache conditions.
-
Medium 4.3
Authenticated users may view private Puppet module metadata
An authenticated user may view private Puppet module metadata without repository read access.
-
Medium 4.3
Authenticated users may access private NuGet metadata
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
-
Medium 5.3
Anonymous users may access restricted Artifactory repository information
An unauthenticated user may access restricted repository information under specific conditions.
-
Medium 4.3
Bundle writers may alter trusted release information in JFrog Artifactory
A bundle writer may create misleading release promotion information under specific conditions.
-
Medium 4.3
Authenticated users may access private OCI referrer metadata
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
-
Medium 6.5
Publishers without delete permission can overwrite docker layer information
A repository publisher without delete permission may modify protected package content under specific conditions.
-
Medium 5.3
Anonymous users may access restricted Artifactory content under specific configurations
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
-
Medium 4.2
Deleted users may temporarily retain access to JFrog Artifactory
Credentials for a deleted user may remain valid for a short period under specific conditions.
-
Medium 5.5
Denial of Service in Autodesk Installer IPC Channel
A maliciously crafted input, when processed by the Autodesk Installer IPC frame parser, may trigger improper validation of an input-specified position or offset, resulting in an out-of-range substring operation. A malicious actor may leverage this vulnerabili…
-
Medium 5.7
Docker Sandboxes read-only runtime mount writable through its shared-export alias
Docker Sandboxes (sbx) applies the read-only intent of a runtime host mount to the in-guest container bind only: the underlying virtio-fs host-edge grant is added to the sandbox's policy-share allowlist with no access mode. The directory stays writable at its…
-
Medium 5.3
RustFS: Anonymous ListObjectVersions bypasses RestrictPublicBuckets through the ListBucket fallback
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, an anonymous ListObjectVersions request in rustfs/src/storage/access.rs that lacks a direct bucket-policy grant falls back to an s3:ListBucket check and returns before the po…
-
Medium 6.1
RustFS: Object Lock (WORM) protections are treated as absent when bucket metadata cannot be read, allowing retained objects to be deleted
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-rc.1, RustFS Object Lock enforcement in crates/ecstore/src/bucket/object_lock/objectlock_sys.rs lets check_object_lock_for_deletion, delete_prefix, and lifecycle and scanner sweeps tr…
-
Medium 5.4
RustFS: FTPS MKD bypasses IAM CreateBucket authorization
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.create_bucket without authorize_operation for S3Action::CreateBucket, all…
-
Medium 5.1
Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup
Vulnerability-Lookup contains a server-side request forgery (SSRF) vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker lat…
-
Medium 6.5
RustFS: Version-specific object reads authorize the non-version action
RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals without historical-versi…
-
Medium 5.3
Authorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup
An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/<topic> endpoint. The token_required decorator used by the Pub/Sub interface …
-
Medium 5.4
Prowler: Stored XSS in HTML reports through unescaped cloud resource tags
Prowler is a cloud security platform. Prior to 5.37.0, Prowler's HTML output formatter in prowler/lib/outputs/html/html.py inserted finding.resource_tags, assembled by unroll_dict and parse_html_string, into generated reports without HTML escaping, allowing a…
-
Medium 6.8
regclient may leak authentication credentials to external blob stores
regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that…
-
Medium 6.1
Stored Cross-Site Scripting (XSS) via Unescaped CNA Reference Tags in vulnerability-lookup
A stored cross-site scripting (XSS) vulnerability existed in Vulnerability-Lookup in the render_tag_badges Jinja filter used to display reference tags associated with vulnerability records. Values from containers.cna.references[].tags[] were directly interpol…
-
Medium 6.3
Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0
Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input.
-
Medium 6.3
Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0
Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name.
-
Medium 4.4
Admidio writes session IDs and auto-login cookie values to application logs
Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the …
-
Medium 6.5
Admidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #2024
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` handler, which destroys…
-
Medium 6.3
XXE in Ministry of Justice's UYAP Document Editor
Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17.
-
Medium 4.3
Admidio PKCS#12 private key export action lacks CSRF protection
Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive `mode=export` action in `modules/sso/keys.php` exports a PKCS#12 bundle containing the configured private key and certificate, but the CSRF validation line is commented…
-
Medium 6.5
Admidio: IDOR in documents-files.php allows cross-folder file rename and description changes by unauthorized uploaders
Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/documents-files.php` mode `file_rename_save` shares the same root-cause shape as the cross-folder move bug (`05-documents-cross-folder-move-idor.md`): the top-level rights c…
-
Medium 5.4
Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation
Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enabl…
-
Medium 5.2
Admidio's CSRF in registration `send_login` mode resets arbitrary user passwords
Admidio is an open-source user management solution. `modules/registration.php` mode `send_login` regenerates a random password for `user_uuid_assigned`, stores its bcrypt hash in `adm_users.usr_password`, and emails the cleartext to that user. Every other sta…