Archive
19 September 2026
Vulnerabilities first published on this day (UTC), newest first.
9 results · Clear filters · Feed
-
Low 3.5
olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting
A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file src/SearchEngine.php of the component Search Engine. Executing a manipulation of the argument Query can lead to cross sit…
-
Low 3.1
vLLM through 0.29.0 Cross-Request Logits Corruption via bad_words
vLLM through 0.29.0 fails to properly validate bad_words token indices against the model's generation output width in SamplingParams.update_from_tokenizer(). Attackers can supply out-of-bounds token indices that corrupt logits memory of concurrent requests, c…
-
Low 3.7
Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free.
-
Low 3.4
rclone serve docker Path Traversal via Volume Name
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Join(drv.root, name) from the attacker-supplied `name…
-
Low 3.1
rclone before 1.75.1 Path Traversal via Directory Listing Names
rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references …
-
Low 3.3
OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext
OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded creden…
-
Low 3.8
Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user t…
-
Low 3.7
Secure Custom Fields < 6.9.4 - Unauthenticated Post Modification via Front-End Form ID Substitution
The Secure Custom Fields WordPress plugin before 6.9.4 does not properly verify that a front-end form submission corresponds to the form that was rendered to the visitor, allowing unauthenticated users to submit against a different registered form and modify …
-
Low 3.5
Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting
The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallo…