Archive
8 October 2026
Vulnerabilities first published on this day (UTC), newest first.
492 results · Feed
-
Medium 6.3
amqp091-go: Pre-negotiation frame limit is not enforced to 4KB
amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotia…
-
Medium 6.5
Application denial of service via malformed KMS endpoint in MongoDB libmongocrypt
An integer underflow in the KMS endpoint-parsing logic of MongoDB libmongocrypt can cause an allocation failure that terminates the application process. This can occur when an authenticated user modifies a key document in the key vault collection, or when an …
-
Medium 5.9
Docker Sandboxes egress proxy could forward unrecognized client credentials to managed hosts
Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alternate credentials only when their values matched known sentinel values, so untrusted code in an authorized sandbox coul…
-
High 7.1
WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.
-
Medium 5.9
Fail-open response masking in Docker Sandboxes can expose proxy-managed credentials
Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together with an error, affected handlers could forward unmasked bytes. Code inside an authorized sandbox could use this to recove…
-
Medium 6.7
Docker Sandboxes OAuth response masking could be bypassed with a case-variant token host
Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while request routing treated DNS hostnames case-insensitively. Untrusted code inside a sandbox could use a case-variant host…
-
Medium 5.9
Query and rename target confusion via embedded NUL truncation in MongoDB C++ Driver
The MongoDB C++ Driver discards content after an embedded NUL byte in certain field and collection names accepted by the collection API. This can cause the driver and the calling application to interpret the same name differently. An authenticated actor who c…
-
Medium 4.0
Silent Decimal128 value corruption via incorrect exactness check in MongoDB C Driver
An incorrect calculation in Decimal128 string parsing in the MongoDB C Driver can accept certain over-precision inputs containing leading zeros instead of rejecting them. This produces a value different from the supplied text. An actor who can provide a decim…
-
Medium 6.2
Out-of-bounds read and write via undersized BSON buffer reservation in MongoDB C Driver
The BSON buffer-reservation API in the MongoDB C Driver can record a length smaller than the five-byte BSON minimum. Later append or comparison operations can underflow unsigned length calculations and read or write outside the document buffer. An actor who c…
-
Medium 5.7
One-byte heap buffer overflow in BSON bulk document writer in MongoDB C Driver
An off-by-one error in the BSON bulk document writer in the MongoDB C Driver can write one zero byte immediately past a heap allocation when a document ends at a specific buffer boundary. An actor who can influence the size of documents serialized by an embed…
-
High 7.8
OS command injection in Amazon Agent Plugins for AWS databases-on-aws
An incomplete list of disallowed inputs in Amazon Agent Plugins for AWS databases-on-aws plugin before 1.7.1 might allow a remote unauthenticated actor to execute arbitrary operating system commands on the host running the helper via a crafted database comman…
-
High 7.4
MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPES
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, text-protocol escaping always prefixes quotes with a backslash and does not honor the session's NO_BACKSLAS…
-
Critical 9.8
image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format
The image_optimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizer#identify_format that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers contro…
-
Critical 9.8
@enmaso/node-convert through 1.0.0 OS Command Injection via filepath and convertTo
@enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into …
-
High 8.2
dot-access through 1.0.0 Prototype Pollution via set() path argument
dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set(). Attackers controlling the path, such as through user-supplied field names, can use __proto__ se…
-
Critical 9.8
dot-access 0.0.3 through 1.0.0 Code Injection via get() Path Argument
dot-access 0.0.3 through 1.0.0 contains a code injection vulnerability that allows remote attackers to execute JavaScript by supplying crafted paths to get(). The path is concatenated into a new Function body in index.js, so attackers can reach constructor.co…
-
Critical 9.8
ppt2png through 0.0.6 OS Command Injection via input and output paths
ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying unsanitized input or output path arguments. Attackers can append shell metacharacters such as ';' to file names passed…
-
Low 3.7
Out-of-bounds read in SCRAM response parsing in MongoDB C Driver
An out-of-bounds read in SCRAM authentication response parsing in the MongoDB C Driver can read one byte beyond a fixed-size buffer when processing a malformed server-final message. A server or network intermediary able to provide this message before server-s…
-
High 8.1
MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4, 3.4.7, and 3.5.4, applications that enable permitSetMultiParamEntries can pass objects whose keys are expanded into a…
-
High 7.5
MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parameters
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4, the GeoJSON Polygon and MultiPolygon binary encoders size a Buffer.allocUnsafe() allocation from each ring'…
-
Medium 5.9
MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLS
MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.3.0 until 3.5.4, the zero-configuration TLS fingerprint-validation path calls Ed25519PasswordAuth.hash() through Authentication.validateFinge…
-
Medium 4.3
QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_h…
-
Medium 5.4
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML() serializes the original entity reference after removing the DTD declaration. A crafted entity such…
-
Medium 6.5
enshrined/svg-sanitize: Denial of Service via DTD Attribute Declaration Crash
savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer allows a crafted SVG DTD with a #FIXED attribute default to make cleanAttributesOnWhitelist() perform a double DOMElement::removeAttribute() call on the same attribute name in src/Saniti…
-
High 8.7
CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>
CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path containing many segments can cause quadratic CPU consumption in cairosvg/path.py. The path tokenizer repeatedly slices and res…
-
High 7.5
datamodel-code-generator: Protobuf weak-import path traversal allows files to be written outside the temporary directory
datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAK_IMPORT_PATTERN and consumed by _write_missing_weak_i…
-
High 8.2
webonyx graphql-php: Unbounded recursion in parser causes stack overflow on crafted nested input
webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive descent without a recursion limit in parseSelectionSet, parseValueLiteral, and parseTypeReference. A remote attacker can sub…
-
High 7.2
In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can …
-
Medium 6.0
In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another pr…
-
High 8.8
JHipster: SQL Injection in the Parameter of JHipster-Generated Reactive (WebFlux + R2DBC) Applicationssort
JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. From 7.0.0 until 9.4.0, reactive applications generated with Spring WebFlux, Spring Data R2DBC, and a SQL database pass the att…
-
High 7.1
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the mainte…
-
Medium 5.5
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
Insecure file permissions in the CodeCatalyst connection handler in AWS Toolkit for VS Code before 4.10.0 allowed local users to obtain CodeCatalyst bearer tokens via reading world-readable token cache files. To mitigate this issue, users should upgrade to ve…
-
Medium 5.4
Incorrect Authorization in Malcolm
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded …
-
Medium 4.3
FFmpeg before 8.1.3 HLS Demuxer Security Check Bypass via parse_playlist()
FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when opening child playlists. Attackers can supply a crafted master playlist whose child playlists use …
-
Medium 5.4
FFmpeg before 7.1.4 and 8.0.2 SSRF via RTSP Redirect Handling
FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without validating the Location URL. Malicious RTSP servers can redirect FFmpeg to inter…
-
Medium 6.5
FFmpeg through 9.0.2 Infinite Loop via RTSP Redirect Handling in rtsp.c
FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit. Attackers controlling an RTSP server can answer every request with a 302 redirect to itself or …
-
Medium 6.5
FFmpeg before 8.1.3 HLS Demuxer Infinite Loop via Self-Referencing Playlist
FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts Master Playlist tags inside Media Playlists. Attackers can trick victims into opening a cra…
-
Medium 6.5
Improper Handling of Highly Compressed Data in Malcolm
Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploaded file …
-
High 8.7
In OpenStack Mistral through 23.0.0, the std.ssh_proxied action passes a caller-supplied proxy_command value directly t…
-
High 7.1
Cross-Site Request Forgery in Malcolm
The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wi…