Archive
18 October 2026
Vulnerabilities first published on this day (UTC), newest first.
76 results · Clear filters · Feed
-
Medium 4.7
aircheng-org iWebShop-5 util.php search sql injection
A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly availabl…
-
Medium 6.3
diem-project diem dmDataLoad.php default password
A vulnerability was found in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmCorePlugin/lib/data/dmDataLoad.php. Performing a manipulation results in use of default password. The attack is possible to be carried out remote…
-
Medium 6.5
light0011 cms Vote VoteController.class.php logic error
A flaw has been found in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is some unknown functionality of the file App/Home/Controller/VoteController.class.php of the component Vote Handl…
-
Medium 5.1
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_…
-
Medium 5.3
light0011 cms Uploadify check-exists.php file_exists file information disclosure
A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this vulnerability is the function file_exists of the file Public/Home/js/uploadify/check-exists.php of the component …
-
Medium 6.5CVE-2026-97859 Public exploit
Gitea API disclosure of private user social graph, keys and stars
Seven Gitea API routes under `/api/v1/users/{username}` (followers, following, following/{target}, starred, subscriptions, keys and gpg_keys) were registered without the `individualPermsChecker` middleware that enforces the visibility of the target user. An a…
-
Medium 6.3
Gitea release attachment re-linking of issue attachments
Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or comment. A user with write access to the releases of a repository, who knew the UUID of an attachment in that repository, …
-
Medium 6.5
Gitea private profile information disclosure through POST request
The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a signed-in user. Any authenticated user could therefore obtain the full name, location, website and description of a us…
-
Medium 4.3CVE-2026-110311 Public exploit
Gitea draft release creation disclosing attachment metadata
Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the met…
-
Medium 4.3
Gitea watched repositories API disclosure after access revocation
`GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had access to it. A user who watched a private repository while having access, and later lost it, for example through a team pe…
-
Medium 4.3
Gitea reactions accepted on locked issues and comments
The Gitea web handlers for adding and removing reactions on issues and comments did not refuse locked issues for users without write access, although the API did. A signed-in user who could read an issue could therefore add or remove reactions on a locked iss…
-
Medium 6.5
Gitea Actions artifact v4 API unbounded request body
The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow and obtains the runner token of that run could send an oversized request to the artifact service and exhaust the memory …
-
Medium 5.3
Gitea panic on the repositories route of individual users
Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a nil organization and panic. The request needs no authentication and no special configuration. The server answered with a…
-
Medium 5.4
Gitea OpenID account linking without session binding
The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in user had started the linking. Because OpenID 2.0 allows unsolicited assertions, an attacker-controlled OpenID provider …
-
Medium 6.3
itsmeravitejak Online-Examination-System Exam exam.php startExam sql injection
A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This issue affects the function Exam::startExam of the file exam.php of the component Exam Module. The manipulation of the argument topici…
-
Medium 6.3
WongKinYiu yolov9 ONNX Metadata common.py DetectMultiBackend.__init__ code injection
A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of the file models/common.py of the component ONNX Metadata Handler. The manipulation of the argument names/stride leads t…
-
Medium 6.8
@fastify/jwt vulnerable to missing token expiration when per-call options drop global defaults
@fastify/jwt is a JWT utility plugin for Fastify. In versions prior to 10.2.5, the top-level sign and verify methods replace the globally configured defaults with the per-call options instead of merging them, so passing any per-call option silently drops ever…
-
Medium 4.3
dyad-sh dyad OAuth Callback cross-site request forgery
A security flaw has been discovered in dyad-sh dyad up to 1.16.0. Affected by this issue is some unknown functionality of the component OAuth Callback Handler. Performing a manipulation results in cross-site request forgery. The attack may be initiated remote…
-
Medium 4.3
AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting
A vulnerability was identified in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected by this vulnerability is the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Extra-Networks Card Builder. Such manipulation…
-
Medium 6.3
AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection
A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file modules/sd_models.py of the component Model Instantiation. This manipulation of the argument Target causes code injectio…
-
Medium 5.9
libstrophe through 0.14.0 Stack-Based Buffer Overflow via SCRAM Salt in SCRAM_Hi
libstrophe through 0.14.0 contains a stack-based buffer overflow vulnerability in SCRAM_Hi that allows malicious XMPP servers to overflow a 128-byte stack buffer by sending an oversized SCRAM salt. Attackers can send a server-first-message whose s= attribute …
-
Medium 5.9
lwIP through 2.2.1 Stack Out-of-Bounds Write via mDNS Search Response Handler
lwIP through 2.2.1 contains a stack out-of-bounds write vulnerability in mdns_handle_response that allows adjacent attackers to corrupt stack memory by sending mDNS responses with invalid domain names. Attackers on the local link can send multicast PTR answer…
-
Medium 4.3
librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Read via AMFProp_Decode
librtmp (RTMPDump) through 2.6 contains a heap out-of-bounds read vulnerability in AMFProp_Decode that reads an AMF0 strict-array element count before checking that four bytes remain. A malicious RTMP server or man in the middle can send an AMF0 body ending w…
-
Medium 6.4
librtmp (RTMPDump) through 2.6 Heap Out-of-Bounds Write via AMF3_Decode
librtmp in RTMPDump through 2.6 contains an out-of-bounds read and heap out-of-bounds write vulnerability because AMF3_Decode ignores AMF3 property decode failures. Malicious RTMP servers or man-in-the-middle attackers can send oversized AMF3 string lengths, …
-
Medium 6.1
libLAS through 1.8.1 Heap Out-of-Bounds Write via LASSchema VLR
libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose …
-
Medium 5.5
libdvdnav before 7.0.0 Out-of-Bounds Read in dvdnav_describe_title_chapters
libdvdnav before 7.0.0 contains a heap out-of-bounds read vulnerability in dvdnav_describe_title_chapters that allows attackers to read beyond the part-of-title array by supplying an oversized vts_ttn value. Attackers can provide a crafted DVD or disc image d…
-
Medium 5.5
libdvdnav through 7.0.0 Out-of-Bounds Read via set_PTT JumpTT
VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supplying an invalid JumpTT title number checked only by an assert. Attackers can craft a DVD or disc image whose First Pla…
-
Medium 5.5
wvWare wv through 1.2.9 Heap Out-of-Bounds Read via wvGetSTSH
wvWare wv through 1.2.9 contains a heap-based out-of-bounds read vulnerability in wvGetSTSH in stylesheet.c that allows attackers to crash applications by supplying crafted Word stylesheets. Attackers can provide a .doc file with ten or fewer styles or out-of…
-
Medium 5.5
wvWare wv through 1.2.9 Stack Out-of-Bounds Read via wvGetPAPX_FKP and wvGetCHPX_FKP
wvWare wv through 1.2.9 contains a stack-based out-of-bounds read vulnerability in wvGetPAPX_FKP and wvGetCHPX_FKP caused by an unvalidated FKP run count. Attackers can supply a crafted .doc file with a large crun value to read kilobytes past the 512-byte sta…
-
Medium 5.5
Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing
Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by…
-
Medium 5.5
Schroedinger libschroedinger through 1.0.11 Out-of-Bounds Read via schro_params_set_default_quant_matrix
Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantiser table by supplying unvalidated wavelet filter index or transform depth values. Attackers can deliver a crafted low-d…
-
Medium 6.1
libspatialite through 5.1.0 Integer Overflow in WKB Geometry Parsing
libspatialite through 5.1.0 contains an integer overflow vulnerability in the WKB point and vertex count size guard of ParseWkbLine and related parsers in gg_wkb.c, allowing out-of-bounds reads. Attackers can supply a crafted geometry BLOB with a large point …
-
Medium 6.5
Xinference through 4.0.1 Path Traversal via model_name in Custom Model Registration
Xinference through 4.0.1 contains a path traversal vulnerability on Windows that allows unauthenticated attackers to write and delete arbitrary .json files via backslash sequences in model_name. Attackers can register a persisted custom model through POST /v1…
-
Medium 5.5
Vita3K before build 4187 Path Traversal via VPK Package Installation
Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_content() that allows attackers to write files outside the install directory via crafted .vpk archives. Attackers can embed '..' segments or absolute paths in zip e…
-
Medium 6.1
libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_Geom…
-
Medium 5.4
OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on clusters outside their scope by exploiting project-wide permission checks. Attackers can call the AI access test, agent reset…
-
Medium 5.5
OW2 ASM 9.11 before 9.11.1 Denial of Service via Infinite Loop in Label.resolve()
OW2 ASM 9.11 before 9.11.1 contains an infinite loop vulnerability in Label.resolve() caused by 16-bit forward-reference offsets truncating when rewritten methods exceed 64 KB. Attackers can supply crafted class files whose transformed code grows past 65535 b…
-
Medium 4.3
AUTOMATIC1111 stable-diffusion-webui Metadata Extraction sd_models.py read_metadata_from_safetensors allocation of resources
A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of the file modules/sd_models.py of the component Metadata Extraction. The manipulation of the argument header length fiel…
-
Medium 4.3
AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting
A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This affects the function create_item_html of the file modules/ui_extra_networks.py of the component Card Builder. The manipulation of the argument filename leads to cross si…
-
Medium 6.1
cgltf through 1.15 Heap Out-of-Bounds Read via cgltf_accessor_unpack_floats()
cgltf through 1.15 contains a heap out-of-bounds read vulnerability in cgltf_accessor_unpack_floats() that advances the sparse values cursor by the base bufferView byteStride. Attackers can supply a crafted glTF or GLB file that passes cgltf_validate() to rea…