Archive
26 October 2026
Vulnerabilities first published on this day (UTC), newest first.
768 results · Feed
-
Medium 6.5
SourceCodester Online Food Ordering System delete_admin.php missing authentication
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate t…
-
Medium 4.7
SourceCodester Online Food Ordering System add_food.php unrestricted upload
A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. T…
-
High 8.8
Apache Airflow SSH provider: SSHRemoteJobOperator: `environment` values are executed as shell on the remote host
In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed…
-
Medium 4.9
YesWiki before 4.7.0 SQL Injection via despam.php INTERVAL operand
YesWiki before 4.7.0 contains a sql injection vulnerability in despam.php where the from parameter is escaped but placed in an unquoted INTERVAL position. Authenticated administrators can inject SQL via the from POST parameter to perform blind reads of the da…
-
Medium 6.8
YesWiki before 4.7.0 SSRF via copyUrlToLocalFile in Bazar CSV Import
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows authenticated administrators to make arbitrary outbound requests by supplying crafted URLs in CSV file or image fields.…
-
Medium 6.8
YesWiki before 4.7.0 Authenticated SSRF via Page Duplication API downloadFile
YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated administrators to make arbitrary outbound requests via the files array. Attackers can POST file:// or internal URLs to /a…
-
Medium 6.5
YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox
YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can rep…
-
Medium 6.1
YesWiki before 4.7.0 Stored XSS via Referer Header in referrers_sites Handler
YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allows unauthenticated attackers to inject scripts via crafted Referer headers. Attackers can send a Referer hostname containing HTML metachara…
-
Medium 6.1
YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback
YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue() fa…
-
Medium 5.3
YesWiki before 4.7.0 Template Traversal via BazarListeAction template Parameter
YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values …
-
Medium 5.3
YesWiki from 4.6.0 before 4.7.0 SQL Query Disclosure via showreq Parameter
YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers to view assembled SQL queries by adding the showreq parameter. Attackers can append showreq to public Bazar listing API requests to obtain t…
-
Medium 6.5
YesWiki before 4.7.0 Read-ACL Bypass via SQL LIKE Wildcards in Usernames
YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL…
-
High 8.5
OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC…
-
High 8.2
OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Att…
-
Medium 4.3
OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts
OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events…
-
Medium 6.5CVE-2026-116817 Scanner template
OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board
OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or…
-
Medium 6.5
OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs
OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs. Users with log access can obtain database credentials from migration startup logs and password-reset to…
-
Medium 6.5
OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts
OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to inject ClickHouse SQL through unescaped event names and dates. Attackers can break out of string liter…
-
Medium 6.5
OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter
OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose nam…
-
High 8.8
OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template
OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into…
-
Medium 5.3
OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences
OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any project's annotations by calling the public reference.getChartReferences tRPC procedure. Attackers can send requests with guessable slug-ba…
-
Medium 5.3
OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectI…
-
High 7.2
OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses an…
-
Medium 6.5
OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter names into a JOIN subquery. Attackers can supply a crafted filter name with a trailing comment to byp…
-
Medium 5.4
OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation
OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that allows non-admin organization members to create projects and mint write-type ingestion credentials, bypassing the admin-only policy. Attackers c…
-
Medium 4.3
OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list
OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of ingestion credentials through the client.list tRPC query. Attackers can request client.list with a project ID and recei…
-
Medium 6.1
DOMPurify before 3.4.17 DOM XSS via IN_PLACE Hook-Detached Subtrees
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed when an IN_PLACE hook removes a parent or sibling node. Attacker markup in detached subtrees is never walked or neutralized, so handlers l…
-
Medium 6.1
DOMPurify from 3.4.4 before 3.4.17 SAFE_FOR_TEMPLATES Bypass via Shadow Root Content
DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes…
-
Medium 6.1
DOMPurify before 3.4.17 XSS via SMIL attributeName Guard Bypass in XHTML Mode
DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attributeName=href guard when PARSER_MEDIA_TYPE is application/xhtml+xml, because transformCaseFunc does not lowercase attribute names. Attackers ca…
-
Medium 6.2
WWBN AVideo before 29.5.0 Local PHP File Inclusion via Accept-Language Header
WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to include PHP files outside the locale directory via a crafted Accept-Language header. Attackers can use overlapping traversal sequences like ....//…
-
Medium 4.3
Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query
Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo relation queries, so supplying a query operator instead of an object ID bypasses the owning-object ACL check. A client with read access to …
-
Medium 6.5
SourceCodester Online Food Ordering System delete.php unlink path traversal
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be c…
-
Low 2.4
Argilla TextField.vue cross site scripting
A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The manipulation of the argument text results in cross site scripting. Th…
-
Low 2.4
Argilla Sandbox.vue cross site scripting
A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-frontend/components/features/annotation/container/fields/sandbox/Sandbox.vue. The manipulation of the argument template leads to cross site …
-
Medium 5.9
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and ControllerRevision objects to create a cross-namespace pod. An attacker exploiting this vulnerability would have full c…
-
Medium 5.8
Subpath symlinking on Windows nodes permits NTLM coercion
An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that points to an attacker-controlled network share. When a kubelet resolves symlinks, it does not reject a target that resolves…
-
Low 3.5
Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument…
-
Medium 6.3
itsourcecode Online Book Store book.php sql injection
A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to be carried out remotel…
-
High 8.7
compress zstd: Panic on two-block frames
compress provides various compression algorithms. Prior to 1.20.2, the zstd DecodeAll and streaming decoder paths can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 that readNCount stores in int16 as -32768.…
-
High 8.8CVE-2026-116748 Scanner template
Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response …