Archive
9 November 2026
Vulnerabilities first published on this day (UTC), newest first.
525 results · Feed
-
Medium 4.3
SourceCodester Smart Attendance System with QR Code Scanner cross-site request forgery
A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack…
-
Medium 6.9
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown fu…
-
High 8.7
Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in src/dissectors/ec_…
-
High 7.2
Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c …
-
High 7.5
Ettercap through 0.8.4.1 Stack Buffer Overflow via WPA CCMP Decryption
Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to …
-
High 7.2
Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwr…
-
High 8.1
Ettercap through 0.8.4.1 Out-of-Bounds Read via sslw_remove_sts
Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS …
-
High 7.2
Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c th…
-
High 8.0CVE-2026-125399 Public exploit
Fluxion before 6.39 OS Command Injection via Crafted SSID
Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes access point ESSIDs with eval after escaping only single quotes. Attackers within Wi-Fi range can broadcast an access point with a crafted SSID …
-
High 8.8
Ettercap through 0.8.4.1 Use-After-Free via PCRE2 Filter Substitution
Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt…
-
High 7.1
Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated user…
-
High 7.8
Ghostscript before 10.08.0 -dSAFER Bypass via .putgstringcopy .forceput Recovery
Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that tri…
-
High 7.1
NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() tha…
-
Medium 5.4
Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 t…
-
Medium 5.3CVE-2026-125394 Public exploit
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and …
-
Medium 5.4
Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View
Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containin…
-
High 7.1
MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that a…
-
High 7.2
Webmin through 2.670 OS Command Injection via Samba User Account Options
Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags pa…
-
Medium 5.3
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in th…
-
High 7.1
Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderControl…
-
Medium 6.5
Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/repor…
-
Medium 6.0
langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageContr…
-
Medium 5.4
Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/a…
-
High 7.1
INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbi…
-
Critical 9.8
INDOTALENT WHMS before 10.20261109 Hard-Coded JWT Signing Key Authentication Bypass
INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tok…
-
Critical 9.8
INDOTALENT WHMS before 10.20261109 Default Administrator Credentials via UserAdminSeeder
INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers to gain administrator access because UserAdminSeeder creates admin@root.com with password 123456. Attackers can log in with these credentials…
-
High 8.6
Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-admini…
-
Medium 6.0
DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role us…
-
Low 3.1
Movim through 0.35.5 Authorization Bypass via Post::ajaxGetPost Cached Post Read
Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or…
-
Medium 6.5
DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test
DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT …
-
Medium 5.3
PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/…
-
Medium 5.3
VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles l…
-
High 7.1
Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users …
-
Medium 5.4
MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlers
MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning an…
-
Medium 5.3
IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to acces…
-
Medium 5.3
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and det…
-
Medium 4.3
REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpoints
REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-d…
-
Medium 4.8
Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, s…
-
Medium 6.9
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers…
-
Critical 9.8
Kubero 3.0.0 through 3.1.1 Authentication Bypass via Hardcoded JWT Secret
Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge administrative JWTs by using a hardcoded fallback signing secret when JWT_SECRET is unset. Attackers can sign tokens with arbitrar…