Archive
9 October 2026
Vulnerabilities first published on this day (UTC), newest first.
332 results · Feed
-
High 8.8
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do not universally requ…
-
High 8.1
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only account is therefore is…
-
High 8.8
SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token
SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and refresh tokens embed a role claim at issuance that is not revalidated against the account's current role when redeemed through POST /api/v1/auth/refresh-token. At…
-
High 8.2
Denial of Service via Eager Array Allocation During Deserialization in Guava
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashS…
-
Medium 6.1
SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content
SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), whi…
-
High 7.2CVE-2026-104082 Public exploit
SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token to bypass the Volume Mount script-directory containment control by provisioning a new mail domain with an arbitrary Fil…
-
High 8.8
ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import
ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSecurity) that allows authenticated authors to write executable files. Attackers with question pool import rights can imp…
-
Medium 5.4
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}. Attackers can obtain workflow UUIDs from GET /workflow/search and supply them because s…
-
Medium 4.3
ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search
ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/search endpoint that exposes other users' private workflows. Authenticated non-admin users can query this endpoint, which lacks owner or is_public filtering, to l…
-
Medium 6.8
MOVO through 0.2.3 Authorization Bypass via Document Endpoints
MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints that allows authenticated users to access other users' stored objects by supplying arbitrary object paths. Attackers who know a target's object path can send …
-
High 8.8
Nginx UI: Node Secret Credential Exposure via URL Query Parameter
Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring the X-Node-Secret hea…
-
Critical 9.4CVE-2026-107806 Public exploit
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The resto…
-
High 7.1
WordPress Post Author Authenticated SQLi
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author version 4.0.0 prior to 4.1.0.
-
Critical 9.8
Savannah lwIP SMTP client Classic Buffer Overflow
lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.
-
Medium 4.9
WordPress Post Author Authenticated SQLi
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp-post-author before 4.1.0.
-
High 7.5
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptogr…
-
Medium 5.3
Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout
Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external client identity used by Gin because the backend has no trusted proxy configuration. Management requests can be attribut…
-
High 8.5
Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile
Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms allows a local attacker with standard container privileges to achieve code execution in the host sentry process by double-freeing the backing MemoryFile from an …
-
Medium 4.9
Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel
A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist n…
-
High 8.3
Red Lion Controls N-Tron 700 Series Reachable Assertion
Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots.
-
High 7.1
Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check
No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating …
-
High 8.1
Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function
SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.
-
High 7.5
Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format
Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.
-
Critical 9.1
PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code
PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php that allows unauthenticated attackers to brute-force the 6-digit otp_code. Attackers knowing a customer username can g…
-
High 7.1
PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()
PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verification because Password::chap_verify() returns true when the supplied response does not match. Attackers who know a valid customer or PPPoE username can log in t…
-
Critical 9.8
PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php
PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted username, macAddr or nasid parameters to t…
-
High 7.5
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, u…
-
Medium 4.8
Xerial snappy-java 1.1.7.4 before 1.1.10.10 Double Release of Pooled Buffers in SnappyFramedInputStream
Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buffers twice when replacement allocation fails. Attackers can supply framed data with a large declared chunk length to tri…
-
High 8.1
Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials
Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through a TFTP t…
-
Medium 5.4
Stack buffer overflow in illumos reparsed nfs-basic plugin allows local users to crash the daemon
A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in usr/src/cmd/fs.d/nfs/rp_basic/libnfs_basic.c, part of the nfs-basic reparse plugin, copies the host and path components…
-
Medium 6.0
Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
-
Medium 5.4
NULL pointer dereference in illumos nwamd door handler allows local users to crash the daemon
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was su…
-
Medium 6.8
Missing release of passed file descriptors in illumos nscd allows local users to exhaust kernel memory
A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are passed with a…
-
Low 1.9
Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src/cmd/zone…
-
Medium 5.4
Double free in OmniOS and SmartOS ipmgmtd allows local users to crash the daemon
A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees …
-
Low 1.9
Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require t…
-
High 8.1
KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combi…
-
Medium 6.8
Reachable assertion in illumos bhyve REP string instruction emulation allows guest to panic host
A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instru…
-
Medium 5.9
Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN a…
-
Medium 5.3
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modifi…