Archive
October 2026
Vulnerabilities first published in this month (UTC), newest first.
17,198 results · Feed
-
Critical 9.8
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the syst…
-
Medium 4.7
ken678 YznCMS Auth Group Group.php Backend privileges management
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege managem…
-
High 8.2
Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
-
Critical 9.8
Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0…
-
High 7.4
Visual Studio Spoofing Vulnerability
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.
-
Critical 9.8CVE-2026-120209 Public exploit
AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token
AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers can mint a token with reportCode 'dataSet' to access the testTransform endpoint, which passes scripts to GroovyClassLoad…
-
Medium 4.3
FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path
FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux…
-
High 7.5
libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder
libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in unc_decoder_mixed_interleave::processTile() that allows attackers to write out of bounds by supplying chroma components with unequal bit depths. Attackers can craft a HEIF fil…
-
High 7.1
Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes
Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to delete page tags, documents and images by abusing back-office delete routes lacking CSRF tokens and permission checks. Attackers can lure a log…
-
Medium 5.9
Thelia before 3.2.0 Back-Office CSRF via URL Token and Unprotected Actions
Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to forge administrative actions because per-session CSRF tokens leak via URL query strings. Attackers can reuse leaked tokens or target the unprot…
-
High 8.0
Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped customer names. Attackers can register with a script payload as their name that ex…
-
High 8.8
ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates
ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mo…
-
Medium 5.6
DeepInfer through 0.1.0 Path Traversal via /profile output_dir Parameter
DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET requests from an operator's…
-
Medium 6.5
Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc
Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files. Attackers can distribute a sk…
-
Medium 5.4
Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes
Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate other users' remote sessions via session lifecycle routes. Attackers who obtain a session ID can call the hibernate, r…
-
Critical 9.8CVE-2026-120201 Scanner template
Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header
Jpom 2.10.0 through 2.11.12 contains an authentication bypass vulnerability that allows unauthenticated attackers to gain super-administrator access by injecting query conditions into the JPOM-USER-TOKEN header. Attackers can send a value like 'is not null', …
-
Medium 4.3
LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API
LearnHouse before 1.1.1 contains a missing authorization vulnerability in the assignment API that allows authenticated users to read other users' grades and submissions. Attackers can supply another user_id to the submissions grade endpoint or query submissio…
-
High 8.4
Pre-Auth Heap Buffer Overflow in the Multipart Request
Heap-based buffer overflow in Opengear IM72XX, CM71XX, and ACM70XX firmware versions 4.8.0 through 5.5.2 on console server appliances allows an unauthenticated remote attacker to crash the index.cgi process via a crafted multipart/form-data POST request conta…
-
High 7.5
WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page
WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer re…
-
Critical 9.8
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages
WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages. WebDyne decides whether to run a requested file as a page by matching its name against WEBDYNE_PSP_EXT_RE, which has no end anchor. An application th…
-
Medium 6.1
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and filefield tags fill their value attribute from the request parameter of the same na…
-
Critical 9.8
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback
WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback. When a request matches no file, the PSGI handler retries it as an API route through api_filename. That keeps .. s…
-
Medium 5.4
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes
WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with…
-
High 8.2
`ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)
`ant-releases` downloads and unpacks release archives from the `safe_network` / `autonomi` repositories. When it extracts an archive, it builds each output path by joining the archive entry's **own name** onto the destination directory, with no check for `..`…
-
Medium 5.3
`codeq`: decoding untrusted input can allocate memory from an unchecked length prefix (denial of service)
`codeq` is a serialization library whose `Decode` trait reads length-prefixed values. For `String` and `Vec<u8>`, the length-prefixed `Decode` implementations read a 4-byte big-endian length and allocate a buffer of that size **before** reading the payload. B…
-
Medium 6.5
Web 2.0 Directory <= 2.10.12 - Unauthenticated SQL Injection via 'w2dc_level_filter' Parameter
The Web 2.0 Directory plugin for WordPress is vulnerable to time-based SQL Injection via the 'w2dc_level_filter' parameter in all versions up to, and including, 2.10.12 due to insufficient escaping on the user supplied parameter and lack of sufficient prepara…
-
High 7.5
Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a ha…
-
Medium 5.5
epiphany: TAR-based .xpi with hard links can overwrite user files during WebExtension install
A file overwrite vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, decompress_xpi_thread() used libarchive with archive_read_support_format_all() (and filters), so the ins…
-
Medium 6.5
epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access
A logic error in Epiphany's site permission handling can cause camera and microphone access to be granted when the user only approves a different permission. In src/ephy-window.c, set_permission() stores the user's Allow/Deny choice after a WebKit permission …
-
Medium 6.1
WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter
The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and outpu…
-
Medium 4.3
Germanized for WooCommerce <= 4.1.4 - Authenticated (Subscriber+) Unauthorized Access of Private Data via Activation Token Reuse via Activation Token Reuse After Email Change
The Germanized for WooCommerce plugin for WordPress is vulnerable to Unauthorized Access of Private Data via Activation Token Reuse in versions up to, and including, 4.1.4. This is due to the `on_user_email_changed` hook — which is responsible for rotating th…
-
Medium 6.4
FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' parameter in all versions up to, and including, 3.17.2 due to insufficient input sanitiza…
-
High 7.2
Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and …
-
Medium 6.1
Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter in all versions up to, and including, 3.15.5 du…
-
Medium 6.4
BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name
The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,…
-
High 7.5
WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter
The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'idfield' parameter in all versions up to, and including, 1.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis…
-
Medium 6.4
GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitiz…
-
High 8.8
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment and Path Traversal
The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the render_image function. This is due to unrestricted mass assignment of caller-supp…
-
High 8.0
Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone
A flaw was found in konflux-ci. This vulnerability allows privilege escalation when the user interface proxy automatically disables Transport Layer Security (TLS) certificate verification for connections to internal backend services in environments lacking a …
-
High 8.4
Konflux-ci: remote code execution via eval() in manifest scripts
A flaw was found in konflux-ci. An attacker with repository write access can achieve arbitrary code execution within the Continuous Integration and Continuous Delivery (CI/CD) workflow environment. By injecting shell commands into environment export scripts, …