Archive
29 September 2026
Vulnerabilities first published on this day (UTC), newest first.
39 results · Clear filters · Feed
-
Low 3.5
Toptech TMS7 and TopHAT Cross-site Scripting
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
-
Low 3.7
Toptech TMS7 and TopHAT Eval Injection
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
-
Low 3.3
Freedesktop Poppler SplashClip.cc clipToPath integer overflow
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The …
-
Low 3.3
Freedesktop Poppler FoFiTrueType.cc cvtSfnts integer overflow
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit h…
-
Low 3.4
Uninitialized resource in Media in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker who had…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker who had c…
-
Low 2.7
Authenticated Buffer Overflow Vulnerability in the API Endpoint of HPE Networking Instant On Causes Denial-of-Service
A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the no…
-
Low 3.0
Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On
An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and…
-
Low 3.3
Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking Instant On
A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated local attacker to interrupt the normal operation of the affected service.
-
Low 3.7
Russh: Configured server auth-attempt cap is not enforced in the USERAUTH_REQUEST runtime path
Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/server/encrypted.rs increments self.common.auth_attempts but never compares it with server::Config.max_auth_attempts. An una…
-
Low 3.7
russh: negotiating a MAC-requiring block cipher (CTR/CBC) with mac=none causes a slice-index-out-of-range panic
Russh is a Rust SSH client and server library. Prior to 0.63.1, a connection configured to permit mac=none can negotiate it with a MAC-requiring CTR or CBC block cipher because the selection logic validates needs_mac() only when MAC selection fails. A remote …
-
Low 2.9
Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially r…
-
Low 3.4
Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the r…
-
Low 3.1
Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the…
-
Low 3.1
Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging so…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had c…
-
Low 2.9
Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to ob…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the…
-
Low 3.7
ImageMagick before 7.1.2-32 and 6.9.13-57 Uninitialized Heap Memory Disclosure in GIF Decoder
ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap…
-
Low 2.3
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker…
-
Low 3.7
Timing Side-Channel in SM2 Signature Generation
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing side-channel. Impact summary: An attacker able to measure SM2 signing times may learn information about the per-signature secret nonce, which over man…
-
Low 3.7
Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V
Issue summary: A non-constant-time optimized implementation of scalar point multiplication is used for SM2 private key operations on ARM64 and RISC-V platforms. Impact summary: An attacker able to measure the time taken by, or to observe the cache-line access…
-
Low 3.7
Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves
Issue summary: The generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations with curves that do not have a dedicated implementation leaks information about the secret nonce through timing. Impact summary: An attacker able to me…
-
Low 3.7
QUIC Unvalidated Amplification Credit may be Over Accounted
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplificatio…
-
Low 3.5
Flysystem: WhitespacePathNormalizer's control-character (CorruptedPathDetected) check is bypassed by malformed UTF-8 in the path, affecting every adapter
Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormalizer.php used by Filesystem across adapters calls preg_match with the u modifier and treats both false and 0 as falsy. A…
-
Low 2.1
OAuth credentials not disabled when application is disabled
OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled.
-
Low 2.1
HTML injection
Malicious HTML content could be injected into the help texts of various fields with organizer permissions.
-
Low 2.3
Incorrect session validation for API-uploaded files
The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for …
-
Low 1.7
Customer session fixation
If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attac…
-
Low 2.7
Revenue information leak
A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue.
-
Low 1.3
Checkout validation bypass
A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps.
-
Low 3.8
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Initialization of a Resourc…
-
Low 3.0
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerabi…
-
Low 3.7
Missing Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an unauthenticated user to read CI/CD job trace contents containing sen…
-
Low 3.5
CodeCanyon Rocket LMS Student Profile Image Upload cross site scripting
A vulnerability was determined in CodeCanyon Rocket LMS up to 2.2. This affects an unknown function of the component Student Profile Image Upload. Executing a manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has …
-
Low 3.5
mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting
A vulnerability was found in mwasikz robo-cafe-rms up to 228c44a02823f04e85db32b7137809a2856148fc. The impacted element is an unknown function of the file frontend/update-account.php of the component Edit Profile Feature. Performing a manipulation of the argu…
-
Low 3.7
pbkdf2 rehashes long passwords on every iteration, enabling denial of service
pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on ever…
-
Low 2.7
Netcore NAP930 Backup/Restore backup_common.sh hard-coded key
A vulnerability was determined in Netcore NAP930 0.1.241010.141410. This vulnerability affects unknown code of the file /lib/functions/backup_common.sh of the component Backup/Restore. This manipulation of the argument aes_pass causes use of hard-coded crypto…