Archive
16 October 2026
Vulnerabilities first published on this day (UTC), newest first.
480 results · Feed
-
High 8.8CVE-2026-102607 Public exploit
ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters whe…
-
High 7.7CVE-2026-59970 Public exploit
Tandoor Recipes: Blind SSRF via AI provider URL (api_base)
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an aut…
-
High 8.1
Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or s…
-
Medium 5.7
Tandoor Recipes: ReDoS (Regular Expression Denial of Service) via User-Controlled Automation Regex Patterns
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub() without complexity validation or an execution timeout wh…
-
High 7.1
Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authentic…
-
Medium 5.4
IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to bypass NFS version restrictions due to improper enforcement of the export version flag.
-
Medium 5.4
IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.
-
Low 3.7
IBM i is Affected by an Improper Validation Vulnerability
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers.
-
Medium 4.3
IBM i is Affected By An Improper Authentication Vulnerability in SST / DST
IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
-
Medium 5.4
IBM i is Affected By An Improper Privilege Management Vulnerability in OpenSSH
IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive.
-
High 7.8
IBM i is Affected By An Improper Privilege Management Vulnerability
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.
-
Medium 4.3CVE-2026-111793 Exploited
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-typ…
KEV Nov 10, 2026 -
Medium 5.3
Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding
A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can le…
-
Medium 6.5
Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Se…
-
Medium 5.1
IBM i is Affected by a Denial of Service in Digital Certificate Manager
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it…
-
Medium 5.1
IBM Db2 Genius Hub Improper verification of cryptographic signature
IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
-
Medium 5.5
Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd
A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the…
-
High 8.8
LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcryp…
-
High 8.1
LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, …
-
Medium 5.4
Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumer…
-
Medium 5.3
fish-island-backend through commit 7c61b78 SSRF via /api/web/parse
fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target int…
-
Medium 6.5
AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
AipexBase through commit 690adb9 contains a sql injection vulnerability that allows attackers to inject SQL through the order_by and group_by fields of the /api/data/invoke endpoint. Attackers can supply subqueries or EXTRACTVALUE and UPDATEXML functions that…
-
Medium 5.9
Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query
Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payment records by supplying a trxNo parameter. Attackers can guess transaction numbers, a '7' pr…
-
Medium 4.3
Arkon through 0.9.2 Missing Authorization via Skills Versions API
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding the default skill:read p…
-
Medium 5.4
Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes
Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments' sources because by-id routes in app/routers/sources.py skip can_access_document. Attackers can call the plan, progress…
-
Medium 4.3
Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API
Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neig…
-
Low 3.1
tarteaucitron.js before 1.37.0 ReDoS via Unescaped Cookie Name in cookie.purge
tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie names to cookie.purge. Attackers can plant a cookie from a sibling subdomain or inject a pu…
-
Medium 5.4
tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add d…
-
Medium 6.5
Netcore NR256CN through 1.5.140116 Authentication Bypass via CGI Path Prefix
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths prefixed with l7_web_auth…
-
Critical 9.8
Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()
Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, which copies Basic-auth usernames with unbounded strcpy() calls into 64-byte stack buffers. Unauthenticated attackers can…
-
High 7.5
Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS
Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allows unauthenticated attackers to crash the server via a malformed Authorization header. Attackers can send a Basic Author…
-
Medium 5.4
WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId
WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets because ShowTicketService performs no ownership or queue checks. Attackers can supply anothe…
-
Critical 9.8
WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user ma…
-
Medium 5.3
99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JW…
-
High 7.5
99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fiel…
-
Medium 4.3
Fuint through commit 57ec018 IDOR via bookId in myBookDetail
Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other members' booking records by supplying arbitrary bookId values to /clientApi/book/myBookDetail. Attackers can iterate the au…
-
Critical 9.8
LangChat through commit 2a6285a Missing Authentication on REST API Controllers
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext pas…
-
Medium 6.3
yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints
yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales users to access other users' customer records by supplying arbitrary ids. Attackers can enumerate ids against the get, update, delete and do-ope…
-
High 7.5
ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /api/knowledgebases/{id} …
-
High 7.0
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A…