Archive
27 October 2026
Vulnerabilities first published on this day (UTC), newest first.
29 results · Clear filters · Feed
-
Low 2.3
Asterisk: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, `app_sms.c` copies externally controlled `SMS` lengths into `fixed in-struct buffers`…
-
Low 2.3
pageant: unbounded frame buffering on peer-controlled 4-byte length prefix (memory-exhaustion DoS)
pageant provides a PageantStream type that implements AsyncRead and AsyncWrite traits and can be used to communicate with a running Pageant instance. From 0.2.0 until 0.2.5, PageantStream::new in pageant/src/wmmessage.rs trusts a peer-controlled four-byte len…
-
Low 3.3
russh's SSH agent server is susceptible to unbound allocations via repeated SSH_AGENT_CONSTRAIN_CONFIRM messages
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.65.0, russh::keys::agent::server::serve in russh/src/keys/agent/server.rs accepts repeated SSH_AGENT_CONSTRAIN_CONFIRM records while adding a key and …
-
Low 2.0
Lenient parsing of integers for response body and chunk framing
Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response contents.
-
Low 3.1
CKEditor: Cross-site scripting (XSS) in the engine package
CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specially crafted markup can trigger cross-site scripting when General HTML Support is enabled and specifically configured to allow object conten…
-
Low 2.7
Tanium addressed an insufficient logging vulnerability in Tanium Server.
Tanium addressed an insufficient logging vulnerability in Tanium Server.
-
Low 3.6
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
-
Low 2.5
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
-
Low 3.3
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
-
Low 2.3
Asterisk: Possible RED T.140 Generation Accumulation OOB Write
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` out-of-bounds write during `generation accumulation` using carefully crafted packets, potentially allowing rem…
-
Low 2.3
Asterisk: Possible RED T.140 Heap Buffer Overflow
Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a `T.140 RED` heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing As…
-
Low 3.3
systeminformation: Path traversal in Linux networkStats() allows symlink-based file disclosure outside /sys/class/net
systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStats(iface) implementation uses the caller-supplied interface value in an fs.existsSync() check and to build /sys/class/net/<iface> paths, including the …
-
Low 3.5
A public shared collective always allowed recipients of the link to create pages.
-
Low 3.5
A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or …
-
Low 3.3
The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting use…
-
Low 2.3
rustls: ECH rejection can expose buffered application data to authenticated outer server before `ech_required` alert
In rustls 0.23.44 and 0.23.45, application data that a client buffers before the handshake completes is sent to the server even when the server rejects Encrypted Client Hello (ECH). When the server rejects ECH, the client completes the handshake with the oute…
-
Low 3.7
rustls: An unauthenticated ServerHello poisons the per-name key-exchange record, so later ClientHellos carry only a classical X25519 share
## Summary The client records the server-selected key-exchange group per server name when it processes the ServerHello, before the server is authenticated. A network attacker can answer one connection attempt for a target name with a ServerHello that selects …
-
Low 3.7
Rustls: Brotli certificate decompression can allocate an attacker-controlled amount of memory up to 1 GiB before authentication.
### Summary The built-in (but disabled by default) Brotli certificate decoder bounds the output buffer but accepts an input-selected history window. A header of five bytes can specify a 1 GiB window allocation. A peer can abort a process whose allocator canno…
-
Low 2.3
Host filesystem path disclosure via DNS rebinding
An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address…
-
Low 3.8
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through …
-
Low 1.9
Out-of-bounds write vulnerability in QTextCodec iconv-based encoding impacts Qt
An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This c…
-
Low 3.7
@fastify/session vulnerable to session revocation bypass via a logout race condition
@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call,…
-
Low 3.5
darylldoyle svg-sanitizer before 1.0.0 CSS Injection and Remote Reference Bypass
darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or i…
-
Low 2.3
Push Endpoint Returns Permissive CORS Headers
The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to fal…
-
Low 3.1
Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token
The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.
-
Low 3.7
TiendaCrypto para WooCommerce 1.0.1 - 1.2.1 - Unauthenticated Order Payment Forgery via Webhook HMAC Bypass
The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthenticated attackers to forge webhook no…
-
Low 3.7
qs.stringify with allowEmptyArrays does not encode the keys of empty arrays, allowing query string parameter injection
### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` therefore becomes query string syntax …
-
Low 3.5
Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting
A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8197510c0910f759e06ee67251e5. Affected by this vulnerability is an unknown functionality of the file chat.php. Executing a manipulation of t…
-
Low 3.5
MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting
A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd273ec58cd. Affected is an unknown function of the file chat.php. Performing a manipulation of the argument ID results in cross site scriptin…