Archive
1 November 2026
Vulnerabilities first published on this day (UTC), newest first.
17 results · Clear filters · Feed
-
High 7.6
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string li…
-
High 7.6
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name …
-
High 7.4
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is…
-
High 8.3
Apache Wicket: Configured upload limits are not enforced by the standalone file upload resource
Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which posts the selected file…
-
High 8.3
Apache Wicket: FileUploadToResourceField accepts a client-asserted upload result and allocates the size it names
Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the outcome afterwards over it…
-
High 7.4
Apache Wicket: JavaScriptUtils#escapeQuotes does not escape the backslash, so its output can leave its string literal
Improper encoding or escaping of output in Apache Wicket. org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote,…
-
High 7.4
Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they f…
-
High 7.6
Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.nam…
-
High 7.2
Apache Wicket: The session id is renewed only on the first sign in, not on re-authentication
Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signIn(String, String) method is the entry point through which an applicatio…
-
High 7.5
Ruijie RG-ES205GC Local Firmware Upgrade httpupg.cgi buffer overflow
A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to…
-
High 8.8
Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state
Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state paramete…
-
High 7.1
WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.
-
High 8.8CVE-2026-120232 Public exploit
Horizon DataSys Reboot Restore Standard Kernel Driver shield.sys sub_23908 memory corruption
A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be…
-
High 7.5
Gitea private pull request disclosure on project boards
Repository and organization project boards listed the pull requests that reference each issue on the board without checking whether the viewer can read them. When a private pull request mentions an issue on a board the viewer can open, the board revealed the …
-
High 7.5
Gitea public-only token bypass on bulk organization repository deletion
`DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only restriction of access tokens: the route only checked that the organization itself was public. A public-only token of an owner of a public org…
-
High 7.5
Gitea public-only token bypass in repository and organization creation
Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories through `POST /api/v1/user/repos` and `POST /api/v1/repos/migrate`, but `POST /api/v1/org/{org}/repos`, `POST /api/v1/orgs/{org}/repos`, `POS…
-
High 7.3
Presenton API missing authentication
A weakness has been identified in Presenton up to 0.9.11-beta. Affected by this issue is some unknown functionality of the component API. This manipulation causes missing authentication. It is possible to initiate the attack remotely. The exploit has been mad…