Archive
2 October 2026
Vulnerabilities first published on this day (UTC), newest first.
166 results · Clear filters · Feed
-
Medium 5.3CVE-2026-105030 Public exploit
Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API
Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inactive monitor data by querying dashboard API handlers lacking visibility filters. Attackers can supply a known or guessed …
-
Medium 4.3
UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint
UVdesk support-center-bundle before 1.1.3.3 contains an insecure direct object reference vulnerability in the rateTicket action of Controller/Ticket.php that allows authenticated customers to rate other customers' tickets. Attackers can supply arbitrary ticke…
-
Medium 5.4
Shopclass before 6.2.0 Stored XSS via Listing Description Field
Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts into item listing descriptions when frontend TinyMCE is enabled. Attackers can submit malicious JavaScript, which ItemAct…
-
Medium 6.1
Showdown through 2.1.0 XSS via unescaped quote in href and src attributes
Showdown through 2.1.0 contains a cross-site scripting vulnerability in the makehtml link and image subparsers, which fail to escape double quotes in destination URLs placed into href and src attributes. Attackers can craft markdown links or images containing…
-
Medium 5.4
IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
IDURAR ERP CRM through 4.1.1 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading unsanitized SVG files. Attackers can upload JavaScript-laden SVGs via the profile update or settings upload endpoi…
-
Medium 5.9
Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive
Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration export archives left on the server after transfer. Attackers can download compressed archives generated by users with c…
-
Medium 6.7
OpenLiteSpeed before 1.9.3 Local Privilege Escalation via lsup.sh Auto-Update
OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages from a nobody-writable directory as root. Attackers controlling the nobody web process can replace the package in /usr/lo…
-
Medium —
sqlite3-ruby: Use-After-Free in SQLite Aggregate Arguments in Heap-Allocated Argument Array
## Summary Using `Database#create_aggregate`, `#create_aggregate_handler`, or `Database#define_aggregator` to define an aggregate function that takes two or more arguments, and then evaluating it over TEXT or BLOB column values, can free the Ruby objects hold…
-
Medium 5.8
Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and …
-
Medium 4.0
The Playground feature of Zilliz Attu before 3.0.0 allows SSRF (proxying of requests to private IP addresses).
-
Medium 4.3
Kentico Xperience 13 before 13.0.216 lacks object-level authorization checks for administration API endpoints.
-
Medium 4.0
Armatura LLC Armatura One Insertion of Sensitive Information into Log File
Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged credential.
-
Medium 6.5
Monta monta.app Insufficiently Protected Credentials
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
-
Medium 5.3
Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm
The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor…
-
Medium 6.5
UTMStack < 11.2.16 JPQL Injection via searchPropertyValues
UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploiting UtmNetworkScanService.searchPropertyValues(), which builds a JPQL query with String.format() and executes it via em…
-
Medium 5.3
Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtraction
Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - operand, in multidict_ite…
-
Medium 5.3
UTMStack < 11.2.16 Account Enumeration via Password Reset Endpoint
UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email addresses by observing differing HTTP responses from the POST /api/account/reset-password/init endpoint. Attackers can su…
-
Medium 6.5
@orpc/zod: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.10, the @orpc/zod ZodSmartCoercionPlugin and experimental_ZodSmartCoercionPlugin collect object and record properties in plain objects and resolv…
-
Medium 5.0
UTMStack < 11.2.16 SSRF via IdentityProviderService
UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl() that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a mal…
-
Medium 6.5
@orpc/json-schema: Prototype injection in smart coercion
oRPC is a tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to 1.14.9, the @orpc/json-schema SmartCoercionPlugin uses JsonSchemaCoercer to collect object properties in a plain object and to resolve schema.properti…
-
Medium 5.8
Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @o…
-
Medium 6.3
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, a…
-
Medium 5.3
RPC secret disclosure via vendor data endpoint in Canonical MAAS
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deploye…
-
Medium 6.2
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the access token of another user of the deployment and to cause the application to issue requests to arbitrary interna…
-
Medium 6.5
All in One SEO < 5.0.2.1 - Unauthenticated Arbitrary Shortcode Execution via Search Query
The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user input before deciding which ones to strip, allowing unauthenticated users to execute arbitrary shortcodes registered on t…
-
Medium 5.8
Nx: Path traversal in nx migrate package-migrations extraction
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a target package manifest without validating that it is a contained relative path. A ho…
-
Medium —
rmcp OAuth client fetches server-controlled resource_metadata URLs
## Summary The `rmcp` OAuth client accepts a server-controlled `resource_metadata=` URL from the `WWW-Authenticate` header and fetches it without same-origin or private-network validation. An attacker-controlled MCP server can return a `401 WWW-Authenticate: …
-
Medium 5.3
MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View
MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute listing), the applicatio…
-
Medium 6.5
Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive informati…
-
Medium 4.3
Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data vi…
-
Medium 4.3
Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin …
-
Medium 6.5
Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as devic…
-
Medium 5.3
MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization
MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without re-validating the c…
-
Medium 4.8
MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler
MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured, the event preview renders tag identifiers inside an inline JavaScript onclick attribute. The tag ID value was HTML-esc…
-
Medium 6.2
MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content of string properties was rendered directly into an HTML pre block without HTML-encoding. An attacker who can control o…
-
Medium 5.9
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does not require it. Prior to 7.1.6, src/parser.js splitWord() can receive a flat selector as one word token carrying many class or ID indexes because period and hash characters…
-
Medium 5.9
uv: Path traversal on Windows through wheel extraction
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already pre…
-
Medium 6.3
Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key t…
-
Medium 6.3
Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass
Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a dev…
-
Medium 5.1
MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server
MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked (remote) MISP servers for corresponding event identifiers. The event ID returned by the remote serv…