Archive
29 October 2026
Vulnerabilities first published on this day (UTC), newest first.
26 results · Clear filters · Feed
-
Low 3.7
MariaDB Connector/J : XA recover() trusted server-supplied gtrid and bqual lengths
MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. From 3.0.0 until 3.3.7, 3.4.5, and 3.5.11, the MariaDbPoolConnection.recover() and MariaDbPoolPinnedConnection.recover() implementations trusted the gtrid_le…
-
Low 2.9
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant…
-
Low 3.7
Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used pki.verifyCertificateChain(), pki.createCaStore(), duplicate subject names to process the relevant input or s…
-
Low 3.7CVE-2026-118776 Public exploit
Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used decipher.finish(), CBC and ECB modes, PKCS#7 padding to process the relevant input or security decision. node…
-
Low 3.7
Forge: ASN.1 OID first arc truncation in asn1.oidToDer
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/asn1.js did not range-check the first two arcs of an OID. An application that accepted an untrusted OID string, checked…
-
Low 3.7
Forge: Certificate signature verified with the issuer's RSA signature scheme
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verify(child), _verifySignature(), lib/x509.js to process the relevant input or security decision…
-
Low —
Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
Cedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy templates, and the `is in` scope condition. This advisory only affects JSON-formatted Cedar policy templates containing `is in` scope conditi…
-
Low 2.6
Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Misaligned VMContext via Exception Tags
Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent…
-
Low 2.6
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling
Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the al…
-
Low 3.1
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with w…
-
Low 3.1
Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a beforeSave trigger in object update responses, even to clients without read access to that object or field. An authenticated client able to update an…
-
Low 3.3
ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option
ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause writes beyond the bounds of a heap buffer. An attacker can supply a crafted image that, when processed by a user with the -morph option, cor…
-
Low 3.7
ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder
ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG decoder is disabled. Attackers can supply a crafted image file for processing to trigger the stack overflow and crash the application, causing den…
-
Low 2.3
Alarm data length not validated against received frame length
P-Net before 1.0.3 passes the application alarm callback a data length derived from the variable part length field of a received RTA alarm frame without checking it against the length of the received frame. A short frame can make the callback receive a length…
-
Low 2.9
Endpoint credential minting (insecure default allow-list)
Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from…
-
Low 3.5
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing …
-
Low 2.3
Path Traversal in Szafir
Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue was fixed in version 2.0…
-
Low 1.8
Typed functions with `i31` or `nullref` arguments may panic due to insufficient type-check
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-3982-jqvv-277m For more information see the GitHub-hosted security advisory.
-
Low 3.7
wasi-http p2: outgoing content-length can be invalid or not match body
This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-h4wp-g4x3-7398 For more information see the GitHub-hosted security advisory.
-
Low 3.5
Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow
A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable…
-
Low 3.7
Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping
The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From…
-
Low 3.8
YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax
The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing users with the Contributor role and above to read the site-wide player-preset configuration, and in versions before 2.1.…
-
Low 3.7
WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user accoun…
-
Low 3.7
WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated users to read the reCAPTCHA secret key when one has been saved.
-
Low 3.5
LetterPress < 2.4.0 - Admin+ Stored XSS
The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for ex…
-
Low 3.5
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes i…