Archive
September 2026
Vulnerabilities first published in this month (UTC), newest first.
5,174 results · Clear filters · Feed
-
Medium 4.1
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive…
-
Medium 5.0
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement …
-
Medium 6.6
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a…
-
Medium 5.9
NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A s…
-
Medium 5.3
MISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL
In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constrain…
-
Medium 6.5
MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAX
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator pan…
-
Medium 6.5
MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory …
-
Medium 4.8
MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View
MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name setting was interpolated directly into a JavaScript string literal using an unescaped PHP echo: var org = "<?php echo $org;?>…
-
Medium 5.4
MarketKing < 2.1.72 Missing Authorization via marketking_duplicate_product AJAX
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supply…
-
Medium 4.3
MarketKing < 2.1.72 Missing Authorization via marketking_send_refund AJAX
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by su…
-
Medium 6.9
MISP Unauthenticated Blind SSRF via XML Body Processing
MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains a logic error in its readFile guard condition (readFile && http || https), where PHP operator precedence causes the htt…
-
Medium 5.3
MISP EventsController queryEnrichment allows querying unavailable or legacy modules without validation
In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules to find a match. If the specified module was not present in the enabled modules list, the code silently continued proces…
-
Medium 5.3
MISP Collections: Missing Authorization Check for Sharing Group on PUT Request in collections/add
In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method was POST. However, the underlying CRUDComponent::add() method persists data on both POST and PUT req…
-
Medium 6.9
MISP Installer Log and FIFO Created World-Readable, Exposing Sensitive Credentials
The MISP installer scripts (for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4) create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe to capture all installer output. The log captures highly sensitive data …
-
Medium 4.3
Unbounded post ID array in the bulk reactions endpoint allows denial of service
Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint which allows an authenticated user to cause excessive database load via a craft…
-
Medium 5.1
MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted Ja…
-
Medium 4.3
sfturing hosp_order Public Search Handlers HospitalController.java cross site scripting
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file HospitalController.java of the component Public Search Handlers. The manipulation of the argument Search leads to…
-
Medium 5.1
MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List
MISP contains a reflected cross-site scripting (XSS) vulnerability in the attribute histogram view. The $selectedTypes variable, which is derived from the URL path segment , was interpolated directly into a JavaScript array literal inside an onClick HTML attr…
-
Medium 4.8
MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
MISP contains a reflected cross-site scripting (XSS) vulnerability in the AnalystDataController::viewForObject action. The method accepted a parent object type parameter from the URL without validation and passed it to the Overmind-themed AnalystData thread v…
-
Medium 6.9
MISP CSRF vulnerability in workflow moduleStatelessExecution allows cross-site execution of workflow modules
MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action in unlockedActions disables both the CSRF token check and the field hash validation for that action. Because…
-
Medium 4.3
dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function static_content of the file changedetectionio/flask_app.py of the component visual_selector_data. Executing a manipulation of the argument filename can lead t…
-
Medium 5.4
Out of bounds read in PICT image import
LibreOffice can import PICT images, which may be embedded in documents. An out of bounds read existed when importing an image that uses a colour palette. The palette index held in the image data was used without being checked against the number of entries the…
-
Medium 6.7
Package URLs can be used to exfiltrate arbitrary INI file values and environment variables
URLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a remote server on opening a document containing such links. The check added for CVE-2024-12426 did not recognise ev…
-
Medium 5.4
Stack buffer overflow in CFF to Type 1 font conversion
LibreOffice converts CFF fonts to Type 1 when it subsets a font, which happens when a document is exported to PDF, and CFF fonts may be embedded in documents. A stack buffer overflow existed in that conversion. The converted operators were written into a fixe…
-
Medium 5.4
Stack buffer overflow in CFF font hint handling
LibreOffice can read CFF fonts, which may be embedded in documents. A stack buffer overflow existed when reading the hints of a glyph. The number of hints was checked against the wrong bound, so a glyph declaring more hints than the array can hold wrote past …
-
Medium 5.4
Heap buffer overflow in PDF import stream handling
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing a stream object. The length of the stream was taken from the object's own dictionary and was not checked against the number of bytes actually present, so copying the stre…
-
Medium 5.4
Heap buffer overflow in PDF import encryption handling
LibreOffice Draw can import PDF documents. A heap buffer overflow existed when importing an encrypted document. The length of the decryption key was taken from the document's own encryption dictionary and was used to fill a fixed size key buffer without being…
-
Medium 5.4
Heap buffer overflow in WMF text record import
LibreOffice can import WMF graphics, which may be embedded in documents. A heap buffer overflow existed when importing a text record that carries its own character advance widths. The count of advance values and the length of the text were read separately fro…
-
Medium 5.6
Tauri framework v2 SSRF Protection Bypass via HTTP Redirects
The Tauri HTTP plugin validates requested URLs against the application's configured scope allowlist only once, on the initial request. When the remote server responds with an HTTP 3xx redirect, reqwest follows the redirect internally without re-checking the n…
-
Medium 5.3
Livestatus injection via monitoring filter values
Improper neutralization of newlines in filter values in the monitoring host and service list APIs in Checkmk <2.5.0p14 allows an authenticated user to inject additional Livestatus query headers, bypassing object visibility restrictions in count queries to inf…
-
Medium 6.9CVE-2026-25262 Public exploit
Write-what-where Condition in Primary Bootloader
Memory corruption while processing a crafted ELF file in the Primary Bootloader.
-
Medium 4.9
Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter
The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authe…
-
Medium 6.8
Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled
A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos password authentication is used without SPNEGO, the system fails to verify the identity of the Key Distribution Center (KDC…
-
Medium 4.3
WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (whic…
-
Medium 4.3
ThumbPress <= 6.2.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and nonce verification in the send_deactivation_survey() function registered via the wp_ajax_pl-plugin-dea…
-
Medium 4.3
WP-CRM System <= 3.4.6 - Authenticated (Contributor+) Exposure of Sensitive Information via 'contact_id' Parameter
The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contact_id' parameter. This makes it possible for authenticated attackers, with contribut…
-
Medium 6.5
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read
The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level acces…
-
Medium 5.3
Handily <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Stripe Payment Settings Modification via 'stripe_publishbale_key' Parameter
The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and including, 1.0.3. This makes it possible for unauthenticated attackers to modify Stripe payment configu…
-
Medium 4.3
wpForo Forum <= 3.1.5 - Missing Authorization to Authenticated (Subscriber+) Guest Post Takeover via wpforo_post_edit Action / Forged comment_author_email Cookie
The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated …
-
Medium 4.3
Tutor LMS <= 4.0.7 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Quiz Question/Answer Modification and Deletion via 'payload' Parameter
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.7 via the tutor_quiz_builder_save AJAX action due to missing validation that nested question_id, …