Archive
3 September 2026
Vulnerabilities first published on this day (UTC), newest first.
114 results · Clear filters · Feed
-
Medium 4.7
Gfs2-utils: gfs2-utils: stack overflow via alloca(i_height) in metadata walk
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing c…
-
Medium 5.3
Gfs2-utils: gfs2-utils: heap out-of-bounds read via unchecked ea_num_ptrs in extended attribute processing
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash…
-
Medium 4.7
Gfs2-utils: gfs2-utils: stack overflow via alloca(1<<di_depth) in hash table traversal
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a la…
-
Medium 5.3
Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the des…
-
Medium 6.3
NousResearch hermes-agent Link Title Fetch index.tsx fetchLinkTitle server-side request forgery
A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side req…
-
Medium 5.3
n8n before 2.36.2 Missing Authorization via Insights API
n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitr…
-
Medium 5.3
n8n before 2.34.1 SSRF via Request Helper URI Validation Bypass
n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url…
-
Medium 6.3
n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes
n8n before 2.35.4 and 2.36.x before 2.36.2 contain a query injection vulnerability in the Elasticsearch Document Get All and Google Cloud Firestore Document Query operations, which build their JSON query by interpolating expression values directly into the qu…
-
Medium 6.5
AVideo Server-Side Request Forgery via epg_link parameter
AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders to fetch arbitrary internal URLs. An attacker can supply an internal URL via the epg_link parameter during video upload,…
-
Medium 6.5
AVideo through c91b5975d CSRF via saveLive.php
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost and forbidIfInvalidToken protections. Attackers can craft malicious image tags to overwrite authenticated streamers' RTM…
-
Medium 4.3
AVideo removePoster.php Cross-Site Request Forgery File Deletion
AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbidIfInvalidToken checks. Attackers can craft malicious image tags to delete authenticated victims' live poster and thumbn…
-
Medium 5.4
AVideo Reflected XSS via videoEmbeded.php link parameter
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with --> and inject arbitrary JavaScript that…
-
Medium 5.4
AVideo Reflected XSS via cancelUri in userLogin.php
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers …
-
Medium 5.3
WWBN AVideo Broken Access Control via feed/index.php program_id
WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility checks when a program_id parameter is supplied. Attackers can enumerate playlist identifiers and retrieve unlisted and…
-
Medium 5.3
WWBN AVideo Broken Access Control via Channel Page
WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and group-restricted videos through hardcoded visibility flags and an undefined property. Attackers can access the channel en…
-
Medium 6.9
Cleartext Storage of Sensitive Credentials in OptimiDoc Server (On-Premise)
OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP (for scan delivery), Active Directory (for user list import), and SharePo…
-
Medium 4.3
2FastLabs agent-squad Streaming Agent Response Workflow orchestrator.ts AgentSquad.routeRequest resource consumption
A vulnerability was detected in 2FastLabs agent-squad up to 1.1.4. Affected by this vulnerability is the function AgentSquad.routeRequest of the file agent-squad/typescript/src/orchestrator.ts of the component Streaming Agent Response Workflow. The manipulati…
-
Medium 6.8
An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical acce…
-
Medium 6.5
Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who c…
-
Medium 6.4
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `skype_url` shortcode attribute of the Social Media Follow module in all versions up to, and including, 4.27.6. This is due to a three-part sanitization failure: (1) the `skype_…
-
Medium 6.8
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Reliance on Data/Memory Layout vulnerability. An…
-
Medium 6.5
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the RE…
-
Medium 4.1
Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability…
-
Medium 5.9
RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL…
-
Medium 4.6
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, …
-
Medium 6.4
GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘postBodyCss’ parameter in all versions up to, and including, 2.4.4 due to insufficient input sani…
-
Medium 4.7
ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection
A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode cause…
-
Medium 6.7
VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code execution
Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure.
-
Medium 6.5
SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables, leading to escalation of privilege
-
Medium 6.6
LiME through 1.12.0 Arbitrary File Overwrite via Symlink Following
LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path parameter, allowing unprivileged local users to overwrite arbitrary root-owned files. An attacker who controls the outpu…
-
Medium 6.5
Cheshire Cat AI Memory Collection Endpoint Information Disclosure
Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory points. Authenticated attackers with MEMORY:READ permission can retrieve all users' stored conversation messages and pe…
-
Medium 6.5
FreeRDP before 3.31.0 Information Disclosure via uninitialized heap memory
FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_in…
-
Medium 5.4
FreeRDP before 3.31.0 Heap Out-of-Bounds Read via AVC444
FreeRDP before 3.31.0 contains a heap out-of-bounds read vulnerability in the general_ChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A malicious RDP server can craft a RFX_AVC444_BITMAP_STREAM with specific frame geometry to trigger an o…
-
Medium 4.3
langgenius dify Splash Layout splash.tsx router.replace cross site scripting
A vulnerability was determined in langgenius dify 1.13.0. Affected is the function router.replace of the file web/app/(shareLayout)/components/splash.tsx of the component Splash Layout. This manipulation of the argument redirect_url causes cross site scriptin…