Archive
4 November 2026
Vulnerabilities first published on this day (UTC), newest first.
147 results · Clear filters · Feed
-
Medium 4.9
Webmin: SSRF exploit in Upload and Download and File Manager modules
Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses b…
-
Medium 5.3
Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce
Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView requires only IsAuthentica…
-
Medium 5.3
Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-…
-
Medium 5.3
GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds
GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feeds and then access cont…
-
Medium 6.5
VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint
VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user records. Attackers can…
-
Medium 5.3
ezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header
ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-Forwarded-For value. An…
-
Medium 4.3
NST Labs Tech Nstbrowser Local Agent API info information disclosure
A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It is possible to launch…
-
Medium 5.4
VitaFit Cloud API Stored XSS via SVG File Upload
VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the application's failure …
-
Medium 6.9
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the fir…
-
Medium 6.5
VitaFit Cloud API IDOR via profile_id Endpoints
VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /front/profile/{profile_i…
-
Medium 4.3
NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of service
A security flaw has been discovered in NST Labs Tech Nstbrowser up to 1.2.1. The affected element is the function stopAllBrowsers of the file /api/agent/browser/stopAll of the component Local Agent Management Service. Performing a manipulation results in deni…
-
Medium 6.9
Sandboxie-Plus: Sandbox containment bypass
Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGID_FILE_SET_ATTRIBUTES or MSGID_FILE_SET_SHORT_NAME to SbieSvc and cause the SYSTEM service to open and modify an existing…
-
Medium 6.5
Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled session…
-
Medium 6.5
Readest: Cross-tenant object write via unsanitized fileName in /api/storage/upload (object-key path traversal)
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user'…
-
Medium 6.5
Mongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote requests reaching mg_h…
-
Medium 5.5
nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nvm use --save` and `nvm install --save` (or `-w`) write the resolved version to `$PWD/.nvmrc` with `tee`, which follows…
-
Medium 6.2
Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity
Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which…
-
Medium 5.5
nvm prints the contents of any readable file through a symlinked .nvmrc
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether `.nvmrc` is a symbolic link. A repository or archive that ships `.nvmrc` as a symlink to anothe…
-
Medium 6.3
yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management
A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of the argument perms ca…
-
Medium 6.3
NPC-Worldwide npcpy MLX Provider response.py get_mlx_response input validation
A vulnerability was found in NPC-Worldwide npcpy up to 2.1.27. This vulnerability affects the function get_mlx_response of the file npcpy/gen/response.py of the component MLX Provider. The manipulation of the argument model results in improper input validatio…
-
Medium 4.7
Jan 0.8.5 before 0.8.8 Workspace Guard Bypass via Dangling Symlink
Jan from 0.8.5 before 0.8.8 contains a workspace guard bypass vulnerability in the agent-tools gate.rs that allows attackers to write files outside the workspace via dangling symlinks. Attackers supplying a malicious repository can use prompt injection to mak…
-
Medium 4.7
jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters
jsondiffpatch before 0.7.7 contains a cross-site scripting vulnerability that allows attackers to inject markup by supplying an unescaped array-move destination index in a delta. Attackers who control a delta passed to formatters.html.format() or formatters.a…
-
Medium 6.5
IBM Watson Speech Services Cartridge is vulnerable to a Path Traversal in LangSmith
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary files from the local filesystem due to path traversal.
-
Medium 5.3
IBM Watson Speech Services Cartridge is vulnerable to an Out-of-bounds Read in Onnx
IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.
-
Medium 6.3
NPC-Worldwide npcpy sft.py load_sft_model code injection
A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.27. This affects the function load_sft_model of the file npcpy/ft/sft.py. The manipulation of the argument base_model_name_or_path leads to code injection. The attack can be initiated remotely. T…
-
Medium 4.3
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to exposure of error messages containing internal implementation details.
-
Medium 4.6
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper restriction of rendered UI layers or frames.
-
Medium 5.4
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-Options header allowing MIME type sniffing.
-
Medium 4.3
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers.
-
Medium 4.3
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to obtain sensitive information due to missing required cryptographic step.
-
Medium 5.9
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 improperly validates TLS certificate validation, which could allow an attacker to obtain sensitive information using man in the middle technique.
-
Medium 6.5
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to improper access control.
-
Medium 4.3
Multiple vulnerabilities that affects IBM Db2 Genius Hub
IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to cause a denial of service due to improper validation of user-influenced resource identifiers.
-
Medium 6.1
draw.io: Prototype pollution in GraphML (mxGraphMlCodec)
draw.io is a configurable diagramming and whiteboarding application. Prior to 31.1.5, the GraphML decoder contains a prototype-pollution vulnerability. Attacker-controlled GraphML reference keys can address inherited object properties, including prototype obj…
-
Medium 5.8
draw.io: Incomplete SSRF blocklist in `ProxyServlet` / `Utils.sanitizeUrl`: RFC 6598 CGNAT range `100.64.0.0/10` is not blocked -> server-side request to internal CGNAT hosts
draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete server-side request forgery blocklist. When the endpoint is enabled, the URL validator does not reject the RFC 6598 share…
-
Medium 5.8
Trawl 1.5.0 before 1.10.0 SSRF via IPv4-mapped IPv6 MCP Policy Bypass
Trawl 1.5.0 before 1.10.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass the MCP outbound URL policy using IPv4-mapped IPv6 addresses. Attackers can supply hex-normalized addresses like ::ffff:7f00:1 direc…
-
Medium 5.3
blueprintUE Self-Hosted Edition before 4.3.3 Account Enumeration via Password Reset
blueprintUE Self-Hosted Edition before 4.3.3 contains an account enumeration vulnerability in ForgotPasswordMiddleware.php that allows unauthenticated attackers to identify registered email addresses. Attackers can compare password reset redirect targets for …
-
Medium 5.3
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 Login Rate Limit Bypass
BlueprintUE Self-Hosted Edition 4.2.0 before 4.3.4 contains a login rate limit bypass vulnerability in LoginMiddleware.php that keys failed-login counters on case-sensitive usernames. Unauthenticated attackers can vary username casing against case-insensitive…
-
Medium 6.7
Powerlevel10k before 1.20.19 Insecure Temporary Directory via gitstatus Installer
Powerlevel10k before 1.20.19 contains an insecure temporary directory vulnerability in the bundled gitstatus/install script that reuses attacker-creatable directories when mktemp fails. Local attackers can pre-create the predictable gitstatus-install.tmp dire…
-
Medium 4.4
Powerlevel10k before 1.20.19 Symlink Following via Instant Prompt Temporary File
Powerlevel10k before 1.20.19 contains a symlink following vulnerability in _p9k_dump_instant_prompt that allows local attackers to overwrite victim-writable files via a predictable temporary path. Attackers can pre-plant symlinks at p10k-instant-prompt-output…