Archive
2 November 2026
Vulnerabilities first published on this day (UTC), newest first.
193 results · Clear filters · Feed
-
Medium 5.9
@fastify/http-proxy vulnerable to prefix escape via percent-encoded backslash dot-segments
@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a p…
-
Medium 4.4
Information Disclosure via Event Publisher Logging in Multiple WSO2 Products Allows Retrieval of Sensitive Data
When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depend…
-
Medium 6.5
SQL Injection vulnerability in ZTE ElasticNet RNIA R18 NGI product
SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.
-
Medium 5.8
Information Disclosure in Multiple WSO2 Products Allows Exposure of Certificate File Paths
The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can le…
-
Medium 4.6
Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the mana…
-
Medium 5.5
Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may aff…
-
Medium 6.6
Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability …
-
Medium 5.3
PayHere Payment Gateway 2.4.0 - 2.4.5 - Unauthenticated Payment Bypass via Unverified Payment Notification
The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation a…
-
Medium 5.7
DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.
-
Medium 6.5
DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.
-
Medium 5.9
OOB read vulnerability in the peripheral module. Impact: Successful exploitation of this vulnerability may affect servi…
-
Medium 5.9
UAF vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect avai…
-
Medium 5.9
Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may …
-
Medium 5.5
Permission control vulnerability in the WLAN module. Impact: Successful exploitation of this vulnerability may affect …
-
Medium 4.3
DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availabi…
-
Medium 4.7
Buffer overflow vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may aff…
-
Medium 4.3
Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may …
-
Medium 4.0
DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availabi…
-
Medium 6.2
Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affe…
-
Medium 4.8
Account Lock Bypass via User Store Synchronization in Multiple WSO2 Products Allows Brute Force Attacks
The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user st…
-
Medium 4.3
mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting
A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to b…
-
Medium 4.3
mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php cross site scripting
A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedetailsfromfaculty.php. Performing a manipulation of the argument fname results in cross site scripting. The attack may b…
-
Medium 4.8
deepset-ai farm Model Package Loader language_model.py WordEmbedding_LM.load path traversal
A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_filename leads to path…
-
Medium 4.3
deepset-ai farm Tokenizer Loader tokenization.py EmbeddingTokenizer.from_pretrained path traversal
A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to…
-
Medium 6.7
In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation …
-
Medium 5.3
In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial …
-
Medium 6.7
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of…
-
Medium 5.3
In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of se…
-
Medium 5.3
In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a…
-
Medium 6.7
In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escal…
-
Medium 5.3
In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of servic…
-
Medium 5.3
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of ser…
-
Medium 5.3
In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of …
-
Medium 6.7
In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalati…
-
Medium 5.3
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of ser…
-
Medium 5.3
In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of s…
-
Medium 4.1
In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to loc…
-
Medium 4.4
In display, there is a possible system crash due to a logic error. This could lead to local denial of service if a mali…
-
Medium 6.7
In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of pri…
-
Medium 4.4
In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicio…