Archive
17 September 2026
Vulnerabilities first published on this day (UTC), newest first.
144 results · Clear filters · Feed
-
Medium 4.3
vgmstream mus_acm.c parse_mus resource consumption
A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The manipulation results in resource consumption. The attack may be launched remotely. The patch is identified as ae37662ad…
-
Medium 6.4
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnera…
-
Medium 5.3
vm2 before 3.11.2 Information Disclosure via Internal State
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
-
Medium 5.3
BMCtest exposes Ironic without authentication and TLS during the test
In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race with bmctest itself, which reduces the attack window and significantly increases its complexity.
-
Medium 6.8
vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known…
-
Medium 4.0
vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSet…
-
Medium 4.2
vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules b…
-
Medium 5.8
vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling eval with malformed sour…
-
Medium 5.8
vm2 before 3.11.8 Information Disclosure via util.getCallSites
vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alia…
-
Medium 6.1
ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8
ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript: schemes or terminate href attributes t…
-
Medium 5.4
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Cross-Site Request Forgery (CSRF) vulnerab…
-
Medium 5.3
WordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
-
Medium 6.5
WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
-
Medium 5.3
WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions.
-
Medium 5.4
WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
-
Medium 5.3
WordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
-
Medium 5.3
WordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability
Contributor Broken Access Control in Simple Membership <= 4.8.2 versions.
-
Medium 5.4
WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
-
Medium 5.3
WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
-
Medium 6.5
WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
-
Medium 6.4
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.19 - Server Side Request Forgery (SSRF) vulnerability
Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions.
-
Medium 6.5
WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions.
-
Medium 6.5
WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
-
Medium 6.5
WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
-
Medium 5.3
WordPress King Addons for Elementor plugin <= 51.1.81 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in King Addons for Elementor <= 51.1.81 versions.
-
Medium 6.5
WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in JetBlocks For Elementor <= 1.5.2 versions.
-
Medium 6.5
WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
-
Medium 6.5
WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
-
Medium 6.5
WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
-
Medium 6.9
Token revocation record built from unverified JWT claims in AshAuthentication
Improper Verification of Cryptographic Signature vulnerability in team-alembic AshAuthentication allows a caller of the token revocation action to neutralise a revocation or write arbitrary rows into the token resource. AshAuthentication.TokenResource.RevokeT…
-
Medium 6.3
Log injection via an unescaped password reset identity in AshAuthentication
Improper Output Neutralization for Logs vulnerability in team-alembic AshAuthentication allows an unauthenticated attacker to forge application log entries by submitting a password reset identity containing newlines or control characters. AshAuthentication.St…
-
Medium 4.3
Rubygem-foreman_remote_execution: job output readable without object-level view_job_invocations check
A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record.…
-
Medium 5.1
MISP sachertortephp Xml::build() Operator Precedence Bypass Allows Unintended HTTPS SSRF When readFile Is Disabled
In the MISP sachertortephp library, the Xml::build() static method in lib/Cake/Utility/Xml.php contains a logic error in the conditional that gates network-based XML fetching. The original condition was written as: $options['readFile'] && strpos($input, 'http…
-
Medium 4.9
admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligi…
-
Medium 5.4
admin3 through 3.0.0 Session Not Invalidated When a User Account Is Disabled
admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate…
-
Medium 4.0
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Missing Authentication for Critical Functi…
-
Medium 5.8
Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A…
-
Medium 6.5
AVideo Cryptographically Weak PRNG via uniqid Stream Key
AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition, reducing key entropy to approximately one million possibilities per creation second. Attackers who know the channel c…
-
Medium 5.3
WordPress FluentAuth plugin <= 2.1.2 - Email Verification Bypass vulnerability
Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects FluentAuth: from n/a through 2.1.2.
-
Medium 4.8
In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops a…