Archive
21 September 2026
Vulnerabilities first published on this day (UTC), newest first.
289 results · Feed
-
Unscored —
`unzip` is unmaintained
The [unzip](https://crates.io/crates/unzip) crate has only ever released a single version, `0.1.0` (published 2017-12-23), and has seen no further activity. It appears to be unmaintained, and its known path-traversal ("zip-slip") vulnerability will not be fix…
-
Unscored —
Double free / use-after-free in `Consumer::skip` and `Consumer::clear` when an element's `Drop` panics
`Consumer::skip()` and `Consumer::clear()` are not panic-safe. They drop the consumed elements in place and only afterwards call `advance_read_index()` to move the ring buffer's read index past them. If an element's `Drop` panics mid-loop, `advance_read_index…
-
High 7.1
Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header
A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue occurs when the service processes S3 presigned URLs using Signature Version 4 (SigV4). Due to improper validation, the s…
-
High 8.7
Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The progra…
-
High 7.2
Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the con…
-
High 8.7
temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a li…
-
High 8.7
temporalio/tchannel-go zero-chunk call fragment causes process termination
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer ca…
-
High 8.7
temporalio/tchannel-go malformed checksum type causes process termination
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checks…
-
Medium 6.0
temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An a…
-
High 7.1
temporalio/sqlparser malformed MySQL version comments can cause a panic
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc be…
-
Low 3.5
Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting
A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tickets/Services/Tickets.php of the component Kanban Board. This manipulation causes cross site scripting. The attack is p…
-
Medium 4.3
Apache Neethi: Remote policy fetch lacks a total timeout, allowing a slow server to hang the request indefinitely
When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes slowly can keep the fetch alive indefinitely and tie up the calling thread (denial of service). Users are recommended to u…
-
High 7.5
Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU for a long time (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
-
High 7.5
Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, …
-
High 7.5
Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.…
-
High 7.5
Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread stack, crashing the parser (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
-
High 7.1
Temporal Server Schedule exclusion search can cause excessive CPU consumption
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that …
-
Medium 5.3
Missing decompression size limit in agent receiver allows memory exhaustion via push agent data
Improper handling of highly compressed data (data amplification) in Checkmk <2.5.0p14, <2.4.0p37, <2.3.0p51 and 2.2.0 (EOL) allows an attacker who controls a host registered for push mode to exhaust the memory of the agent receiver by sending a small zlib com…
-
Low 1.0
Unsoundness in UTF-8 'String' trait
In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as_str() converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an i…
-
High 8.8
Cri-o: cri-o checkpoint restore bypasses destination security context
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and se…
-
Medium 5.1
Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform
Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat Platform. An unauthenticated remote user could cause external hyperlinks to be rendered in the web interface by sendin…
-
Medium 6.3
Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
MISP's galaxy matrix statistics view (app/View/Users/statistics_galaxymatrix.ctp) renders the galaxy name directly into HTML output via sprintf() without any HTML encoding. An authenticated user holding the perm_galaxy_editor permission can create or modify a…
-
Critical 9.1
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forw…
-
Medium 5.3
Payment Gateway for PayPal on WooCommerce < 9.2.1 - Unauthenticated Payment Bypass via Sandbox IPN Environment Confusion
The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confirmed in the store's configured payment environment or paid to the store's own merchant account before marking an order c…
-
Low 3.7
To Do List Member 1.4 - 1.6 - Unauthenticated Content Injection via Import
The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetches the imported data from, allowing unauthenticated users to create arbitrary published posts and t…
-
Medium 5.3
RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-ch…
-
Medium 6.5
GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbit…
-
Medium 4.3
Omega Solution FBP Fulfillment by People User Profile API user authorization
A security vulnerability has been detected in Omega Solution FBP Fulfillment by People 2025. This impacts an unknown function of the file /user/ of the component User Profile API. The manipulation of the argument ID leads to authorization bypass. Remote explo…
-
High 8.0
Cri-o: cri-o: insufficient validation during container checkpoint restore
A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to per…
-
Medium 5.3
Omega Solution HRM OS Role Permission API permission missing authentication
A weakness has been identified in Omega Solution HRM OS up to 20260717. This affects an unknown function of the file /role-permission/permission of the component Role Permission API. Executing a manipulation of the argument roleId can lead to missing authenti…
-
Low 2.4
Omega Solution HRM OS SVG File Upload view cross site scripting
A security flaw has been discovered in Omega Solution HRM OS up to 20260717. The impacted element is an unknown function of the file /media/view/ of the component SVG File Upload. Performing a manipulation results in cross site scripting. The attack may be in…
-
Medium 4.3
Omega Solution HRM OS Role Permission Retrieval Endpoint permission resource injection
A vulnerability was identified in Omega Solution HRM OS up to 20260717. The affected element is an unknown function of the file /role-permission/permission of the component Role Permission Retrieval Endpoint. Such manipulation of the argument roleId leads to …
-
High 7.5
Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate
The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not control the resulting size, and create a buffer no matter what. Some compressed data may have a compression ration greater …
-
Medium 5.3
ScadaBR Export Project Endpoint export_project.htm EmportDwr.createExportJSON information disclosure
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initi…
-
High 8.8
BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where
A vulnerability was found in BioStar BIOS Update Utility 1.9.7.3. This issue affects the function sub_110BC of the file BSMEM64_W10.sys of the component IOCTL Handler. The manipulation of the argument PhysicalAddress/Size results in write-what-where condition…
-
Low 3.1
Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint
A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through…
-
Low 3.5
Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision
A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the p…
-
Low 3.5
xuxueli xxl-job Task Management JobInfoController.java cross site scripting
A vulnerability has been found in xuxueli xxl-job up to 3.4.2/3.5.0. This vulnerability affects unknown code of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobInfoController.java of the component Task Management Interface. The m…
-
High 7.1
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running i…
-
High 7.3
drogonframework drogon ORM Criteria.cc makeCriteria sql injection
A flaw has been found in drogonframework drogon up to 1.9.13. This affects the function makeCriteria in the library orm_lib/src/Criteria.cc of the component ORM. Executing a manipulation of the argument filter can lead to sql injection. The attack may be perf…