Archive
16 September 2026
Vulnerabilities first published on this day (UTC), newest first.
246 results · Clear filters · Feed
-
Medium 6.3
a2ui-project a2ui Message Parsing message-processor.ts processMessages dynamically-determined object attributes
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/web_core/src/v0_9/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determin…
-
Medium 4.8
EspoCRM through 10.0.8 Weak Token Generation via rand()
EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of a cryptographically secure generator. Remote unauthenticated attackers can guess these roughly 31-bit tokens to confir…
-
Medium 4.3
a2ui-project a2ui Binder generic-binder.ts openUrl redirect
A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation results in open redirect. It is possible …
-
Medium 5.5
a2ui-project a2ui Angular Renderer server-to-client.ts z.any injection
A vulnerability was detected in a2ui-project a2ui up to 0.10.6. This impacts the function z.any of the file renderers/web_core/src/v0_9/schema/server-to-client.ts of the component Angular Renderer. Performing a manipulation of the argument primaryColor result…
-
Medium 4.6
MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile…
-
Medium 6.1
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes…