Archive
3 September 2026
Vulnerabilities first published on this day (UTC), newest first.
114 results · Clear filters · Feed
-
Medium 6.5
WordPress Business Directory plugin <= 6.4.26 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
-
Medium 5.9
WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
-
Medium 5.3
WordPress BookIt plugin <= 2.6.0.3 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
-
Medium 5.3
WordPress WP EasyPay plugin <= 4.5.3 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions.
-
Medium 6.5
WordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
-
Medium 6.5
WordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
-
Medium 6.5
WordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.
-
Medium 6.5
WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
-
Medium 6.5
WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
-
Medium 6.5
WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.
-
Medium 6.5
WordPress Pre-Orders for WooCommerce plugin <= 2.3 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions.
-
Medium 6.9
Server-Side Request Forgery via Favicon Redirect to Local Network Resources in PlaywrightCapture
PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_lookup is enabled, the application validates the initial favicon URL to prevent requests to localhost, loopback, or other no…
-
Medium 5.1
pymonocypher: Potential heap buffer overflow on nb_blocks in argon2i_32 when provided buffer is too small
pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will wr…
-
Medium 5.3
Note Mark: Unauthenticated disclosure of soft-deleted note metadata via deleted=true on public books in note-mark
Note Mark is an open-source note-taking application. Prior to version 0.19.5, GET /api/books/{bookID}/notes is an unauthenticated endpoint that accepts a "deleted" query parameter. When the request is ?deleted=true, the service runs the query with Unscoped() …
-
Medium 4.3
Arbitrary command execution via shell-expanded connection string in Launch MongoDB Shell terminal
A component of the MongoDB extension for Visual Studio Code does not neutralize special characters in a connection string before that value is placed into a command line the extension composes for an integrated terminal. An unauthenticated remote unauthorized…
-
Medium 5.5
Exterro FTK Imager < 8.3 XXE via Report.xml XSLT Processing
Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets withi…
-
Medium 5.3
Fleet: DNS exfiltration via Sprig getHostByName in fleet.yaml Helm template preprocessing
A security vulnerability was discovered in Fleet's Helm template preprocessing where templates evaluated by the Fleet controller could reach network resources outside the management cluster. A user who can supply bundle content to a repository referenced by a…
-
Medium 4.2
Authenticated KMS request forgery via CRLF injection in GCP key identifier strings
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side…
-
Medium 5.3
Silent field truncation via unchecked int cast of huge JSON string values in JSON-to-BSON parser
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success …
-
Medium 5.9
Heap corruption via OCSP request double free from crafted multi-URL certificate in TLS client
A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that the client already trusts. During the handshake, specially formed certificate data can cause the same heap object to be r…
-
Medium 5.1
Heap write primitive via size round-up wrap during JSON parsing on 32-bit builds
An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a following copy operation still writes through the stale pointer. On builds where sizes are 32 bits, an unauthenticated pa…
-
Medium 5.1
BSON element injection via NUL-embedded document keys in builder append
An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interpreted incorrectly. When an application supplies an extremely large, non-terminated field name to the builder, the libra…
-
Medium 6.5
Persistent client crash loop via undersized FLE2 insert-update ciphertext in decryption path
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an applicat…
-
Medium 6.2
Heap over-read or silent misparse via 32-bit truncation of JSON length in BSON JSON parser
A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text that an embedding application hands to the library's public JSON parsing interface, when that text is very large, can c…
-
Medium 5.3
MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validated only when the widget was rendered and were not validated when the configuration was saved. As a result, an authentica…
-
Medium 6.1
Rancher: Identity-field mutation in /v3/users allows account hijack via principal rebind
A flaw was found in Rancher Manager. The /v3/users update path did not enforce immutability of a User resource's `username` and `principalIds` fields. A user holding the `update` verb on `users.management.cattle.io` could inject a foreign identity provider pr…
-
Medium 6.1
Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and galaxyAttachedAttributes URL parameters were inserted into the query-builder rules without HTML escaping before being s…
-
Medium 5.3
MISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations
MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated wit…
-
Medium 5.4
pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_schedule_edit.php. The schedule description is stored without HTML sanitiz…
-
Medium 5.0
Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements us…
-
Medium 5.4
pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Firewall: Rules: Edit privilege to inject arbitrary JavaScript via the descr parameter in /firewall_rules_edit.php. The firewall rule description is stored in the pfSense XML con…
-
Medium 5.4
pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php
pfSense Plus before 26.07 and CE before 2.9.0 allow authenticated users with the Status: Monitoring privilege to inject arbitrary JavaScript via graph configuration parameters in /status_monitoring.php. Multiple POST parameters including graph-left, graph-rig…
-
Medium 5.0
Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements us…
-
Medium 4.3
Oppia through 3.5.2 Missing Authorization on AdminRoleHandler GET
Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to retrieve usernames …
-
Medium 5.4
CRMEB through 6.0.0 Unauthorized Message Modification via edit_message
CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated users to modify arbitrary system inbox messages. Attackers can update any message's columns including is_del, look, and …
-
Medium 6.3
ILIAS MediaPool ZipAdapter.php uploadMultipleSubtitleFileObject unrestricted upload
A security flaw has been discovered in ILIAS up to 9.21/10.9/11.2. This affects the function ilObjMediaObjectGUI::uploadMultipleSubtitleFileObject of the file Services/Repository/Service/Resources/ZipAdapter.php of the component MediaPool. The manipulation re…
-
Medium 5.8
WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows Reflected XSS. This issue affects Enfold: from n/a through 8.0.
-
Medium 5.5
XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence…
-
Medium 4.3
NousResearch hermes-agent Electron Main Process main.ts resourceBufferFromUrl allocation of resources
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file apps/desktop/electron/main.ts of the component Electron Main Process. Performing a manipulation results in allocation of r…
-
Medium 5.9
Predictable Pseudorandom Number Generation via Webhook HMAC Secret Generation in Multiple WSO2 Products Allows Forged Event Payloads
The API Publisher component previously used a non-cryptographic pseudorandom number generator (PRNG) to create shared secrets for Webhook HMAC validation. This PRNG lacks sufficient entropy for security-sensitive operations, allowing a sophisticated attacker …