Archive
2 September 2026
Vulnerabilities first published on this day (UTC), newest first.
326 results · Feed
-
High 8.7
BookStack before 26.05.4 Stored XSS via Drawing Upload
BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing sc…
-
High 8.8
Coolify before 4.2.0 Remote Code Execution via Environment Variable Key
Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authenticated attackers can inject shell metacharacters into environment variable keys to execute arbitrary commands on the s…
-
Medium 4.3
zhayujie CowAgent Bash Tool bash.py denial of service
A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the component Bash Tool. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The …
-
Medium 4.3
zhayujie CowAgent Browser Tool browser_tool.py BrowserTool denial of service
A vulnerability was found in zhayujie CowAgent up to 2.1.3. This impacts the function BrowserTool of the file agent/tools/browser/browser_tool.py of the component Browser Tool. Performing a manipulation results in denial of service. The attack can be initiate…
-
High 8.6
Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication.
-
High 7.6
Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.