Archive
August 2026
Vulnerabilities first published in this month (UTC), newest first.
4,085 results · Clear filters · Feed
-
Medium 5.4
Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within R…
-
Medium 6.9
Improper conditions check for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a den…
-
Medium 4.6
Inverted bitmap validation in `invalidate_l2_cached_ept`
Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation …
-
Medium 4.6
`enter_l2_vcpu` passes the wrong RCX operand to `TDG.VP.ENTER`
Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation…
-
Medium 6.8
Improper handling of overlap between protected memory ranges in some microcode for some Intel(R) Processors within Ring…
-
Medium 5.4
Protection mechanism failure for some LLM Scaler software within Ring 3: User Applications may allow an escalation of p…
-
Medium 6.7
Improper authentication for some Intel(R) PROSet/Wireless WiFi Software within Ring 0: Kernel may allow an information …
-
Medium 6.3
Exposure of sensitive information to an unauthorized actor for some Intel(R) PROSet/Wireless WiFi Software for Windows …
-
Medium 5.6
Improper initialization in some firmware for some Intel(R) Active Management Technology (Intel(R) AMT), and some Intel(…
-
Medium 6.9
Improper buffer restrictions for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a …
-
Medium 5.4
Protection mechanism failure for some Intel Extension for TensorFlow software before version 2.15.0.3 within Ring 3: Us…
-
Medium 4.5
Always-incorrect control flow implementation in some firmware for some Intel(R) Xeon(R) processors may allow an escalat…
-
Medium 5.9
Insertion of sensitive information into log file in the subsystem for the Intel(R) AMT and Intel(R) Standard Manageabil…
-
Medium 6.8
Hardware logic contains race conditions for some 3rd Gen Intel(R) Xeon(R) Scalable Processors within Ring 3: unprivileg…
-
Medium 6.8
Insecure storage of sensitive information in the Intel(R) TDX module for some Intel(R) platform within Ring 0: Trust Do…
-
Medium 5.4
TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server
TypeBot is a chatbot builder tool. Prior to version 3.17.0, Typebot's WhatsApp status forwarding feature stores a workspace-configured webhook forwarding URL and later POSTs WhatsApp marketing/error status events to it from the server. The stored URL is only …
-
Medium 5.3
DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals
A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session.
-
Medium 6.5
Zoom Clients - Buffer Over-read
Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access.
-
Medium 4.3
CamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET…
-
Medium 4.6
Vim: Out-of-bounds Access in Popup Opacity Handling
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead o…
-
Medium 4.3
Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter.
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenti…
-
Medium 5.3
Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size a…
-
Medium 5.9
CVE-2026-6727
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of cipherte…
-
Medium 6.8
Vim: Stack Buffer Overflow in the Vim Socket Server
Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-siz…
-
Medium 4.3
Insufficient input validation in NETGEAR R7000 router allows administrators to tamper with the device.
Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
-
Medium 4.3
Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
-
Medium 4.9
Command injection vulnerability in some NETGEAR Nighthawk devices
A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker in the middle) to compromise the confidentiality and integrity of the a…
-
Medium 4.3
Some NETGEAR Nighthawk devices allow administrators to tamper with the device
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality.
-
Medium 4.9
Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers
A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. T…
-
Medium 5.9
ToolJet: Cross-tenant Broken Access Control in ToolJet Database (tooljet-db): any authenticated user can read and write another organization's tables
ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :…
-
Medium 6.5
Velociraptor server crash via the SetPassword API
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
-
Medium 6.7
Tesseract: Heap OOB read in the DAWG loader
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load ca…
-
Medium 6.8
Tesseract: Heap out-of-bounds write in LSTM Convolve layer via crafted .traineddata
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata LSTM model component loaded through Tesseract's deserializer can cause an unchecked signed integer multiplication in Convolve::DeSerialize in src/lstm/convolve.cpp to wrap the conv…
-
Medium 6.2
Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes
Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attack…
-
Medium 6.1
SWC HTML minifier may allow script element breakout when minifying embedded JSON
SWC is a TypeScript / JavaScript compiler written in Rust. Prior to @swc/html 1.15.47-nightly-20260729.1 and swc_html_minifier 59.0.0, the minifyJson processing in crates/swc_html_minifier/src/lib.rs parsed and serialized attacker-controlled JSON in applicati…
-
Medium 6.8
Velociraptor VFSGetBuffer API path deny list bypass
The Velociraptor gRPC API has a VFSGetBuffer endpoint which allows reading files from the datastore. To prevent users from reading sensitive files or accessing other orgs, the requested path is prefix checked against a list of denied prefixes. This prefix che…
-
Medium 5.1
Server-Side Request Forgery via Favicon Retrieval in Lookyloo PlaywrightCapture
A Server-Side Request Forgery (SSRF) vulnerability existed in Lookyloo's PlaywrightCapture when the only_global_lookup option was enabled. PlaywrightCapture implements this option to prevent captures from accessing local, loopback, or otherwise non-public net…
-
Medium 5.1
Stored Cross-site Scripting in Pentestify finding severity field
Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates unescape…
-
Medium 6.0
A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is …
-
Medium 4.3
A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01…