Skip to content
OpenAdvisories

Archive

1 November 2026

Vulnerabilities first published on this day (UTC), newest first.

← October 2026 2026 / November /1
  1. 1102
  2. 2473
  3. 3780
  4. 4395
  5. 5456
  6. 6465
  7. 7474
  8. 8323
  9. 9525
  10. 102065
  11. 11692
  12. 12388
  13. 13771
  14. 1465
  15. 1544
  16. 16 
  17. 17 
  18. 18 
  19. 19 
  20. 20 
  21. 21 
  22. 22 
  23. 23 
  24. 24 
  25. 25 
  26. 26 
  27. 27 
  28. 28 
  29. 29 
  30. 30 
All Critical High Medium Low Exploited only Public exploit

48 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-120250

    OpenAlgo 1.0.0.29 before 2.0.3.1 Improper Certificate Validation in SMTP Connections

    OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and utils/email_debug.py that disables TLS hostname and certificate checks for STARTTLS and SMTPS. Network-positioned attackers can present a fo…

    marketcalls OpenAlgo
  • Medium 6.5
    CVE-2026-120249

    Thelia Back-office Default Twig Template before 1.1.1 CSRF via Product Combination Routes

    Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations/update and /admin/product/default-price/update routes, which accept GET requests without anti-CSRF token checks. Attac…

    Thelia Thelia Back-office Default Twig Template
  • Medium 5.5
    CVE-2026-120247

    FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure

    FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows attackers to leak heap memory into decoded pixels via short packed-BGR bitstreams. Attackers can craft a Huffyuv BGR24/BGRA video whose entropy …

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  • Medium 4.8
    CVE-2026-120248

    Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads

    Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by uploading unsanitized SVG logo_file or banner_file images. Attackers can upload an …

    Thelia Thelia Thelia Back-office Default Twig Template Thelia Core
  • Medium 5.5
    CVE-2026-120246

    FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder

    FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pixels via unfilled HAM palette entries. Attackers can craft a type-0 CDXL file whose HAM pixels select unfilled new_palet…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  • Medium 5.5
    CVE-2026-120245

    FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder

    FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that leaves decoded image regions unwritten for truncated input. Attackers can supply a crafted truncated Sun Raster image, R…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  • Medium 5.5
    CVE-2026-120244

    FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder

    FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves scanline buffer bytes uncleared when input ends early. Attackers can supply a crafted truncated RLE-compressed or uncompre…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi
  • Medium 5.5
    CVE-2026-120243

    FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette

    FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stack memory through out-of-range palette indices. Attackers can craft a G2M3/G2M4 stream with a short Kempf palette so kem…

    FFmpeg FFmpeg ffmpeg ffmpeg Debian Ubuntu Wolfi