Archive
13 September 2026
Vulnerabilities first published on this day (UTC), newest first.
133 results · Feed
-
Low 3.0
Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary.
-
Medium 6.3
Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as…
-
Low 3.5
Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.
-
Low 3.1
A Command Injection vulnerability exists in the bs_SetLimitCli_info function within the libshare.so library of the LB-L…
-
Low 2.9
TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectAr…
-
High 7.7
CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a p…
-
Medium 4.3
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.
-
Medium 4.3
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.
-
High 7.4
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra…
-
Medium 5.8
A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php.
-
Low 2.9
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in li…
-
Low 2.9
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in…
-
High 8.1
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different v…