Archive
9 November 2026
Vulnerabilities first published on this day (UTC), newest first.
246 results · Clear filters · Feed
-
Medium 4.3
SourceCodester Smart Attendance System with QR Code Scanner cross-site request forgery
A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack…
-
Medium 6.9
A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown fu…
-
Medium 5.4
Ampache before 8.4.0 Stored XSS via Song Lyrics ID3 Tag
Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 t…
-
Medium 5.3CVE-2026-125394 Public exploit
FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and …
-
Medium 5.4
Webmin through 2.670 Stored XSS via BIND8 edit_recs.cgi ALL View
Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containin…
-
Medium 5.3
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in th…
-
Medium 6.5
Group-Office before 6.8.181, 25.0.116, and 26.0.58 Missing Authorization in Forms Report Download
Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/repor…
-
Medium 6.0
langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in CharacterMessageContr…
-
Medium 5.4
Faveo Helpdesk through 2.0.3 Cross-Department Ticket Tampering via TicketController
Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows authenticated agents to modify tickets outside their department by referencing raw ticket IDs. Attackers can call merge-tickets, change-owner, ticket/a…
-
Medium 6.0
DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role us…
-
Medium 6.5
DataRoom through 3.0.0 Incorrect Authorization via /dataRoom/dataset/run/test
DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows visitor-role users to execute dataset definitions supplied in the request body. Attackers can specify an arbitrary dataSourceCode and raw SELECT …
-
Medium 5.3
PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/…
-
Medium 5.3
VanBlog through 0.54.0 Private Article Disclosure via Public Password Endpoint
VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read private and hidden articles via the POST /api/public/article/:id endpoint. Attackers can submit any non-empty password for private articles l…
-
Medium 5.4
MrDoc through 1.1.1 Missing Authorization via Project Document Sort Handlers
MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning an…
-
Medium 5.3
IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to acces…
-
Medium 5.3
Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and det…
-
Medium 4.3
REBUILD before 4.5.3 Authorization Bypass via Feeds Details and Comments Endpoints
REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-d…
-
Medium 4.8
Tinyproxy through 1.11.3 Hostname ACL Allow-List Bypass via Suffix Match
Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, s…
-
Medium 6.9
Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers…
-
Medium 5.3
Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server…
-
Medium 5.4
Pico through 4.1.2 SSRF in Feeds Service via run SSH Command
Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigge…
-
Medium 5.4
MikroDash before 0.8.79 SSRF via Personal Notification Channels
MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including the viewer role, to target internal addresses through notification channels. Attackers can set webhook or mail destinations to loopback, LAN…
-
Medium 4.3
Mediary Scout before 2026.11.05 SSRF via PanSou Search Source Setting
Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated user, including non-owner accounts, to set an arbitrary PanSou base URL via savePanSouBaseUrlAction without role checks. Attackers can trigger p…
-
Medium 6.9CVE-2026-125357 Scanner template
Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::…
-
Medium 6.1
Kiwi TCMS account confirmation open redirect through protocol-relative URLs
## Summary In Kiwi TCMS version 16.1, the fix for CVE-2026-54724 (open redirect via unvalidated `next` parameter) in the account confirmation endpoint is incomplete. The validation uses `startswith("/")` to check if the redirect URL is local, but this is bypa…
-
Medium 6.1
KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitr…
-
Medium 6.5
Mongoose: Prototype pollution via Schema.prototype.virtual()
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Schema.prototype.virtual() builds nested virtual paths without applying the special-property validation already used by S…
-
Medium 6.4
Path traversal in Amazon Braket SDK local hybrid job input data download
Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the …
-
Medium 4.8
Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.12, 7.8.13, 8.24.7, and 9.11.4, Mongoose uses attacker-controlled discriminator key values, including the default __t field, to index plain-object regist…
-
Medium 6.8
Novu: `validateUrlSsrf` permits CGNAT (100.64.0.0/10) destinations — affects Workflow HTTP request step + Webhook filter condition
Novu provides an API for sending notifications through multiple channels. Prior to 3.17.0, validateUrlSsrf in libs/application-generic/src/utils/ssrf-url-validation.ts uses the isPrivateIp deny-list without covering the RFC6598 100.64.0.0/10 shared address sp…
-
Medium 5.3
XRootD: Path traversal in directory listing allows access to the parent directory via trailing ".." pattern
The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdXrootdXeq.cc rejects …
-
Medium 6.5
Permanent loss of transmit capability in the NXP ENET QoS Ethernet driver after an Ethernet link drop
The NXP ENET QoS Ethernet driver in drivers/ethernet/eth_nxp_enet_qos serialises transmission with a binary semaphore, data->tx.tx_sem, taken in eth_nxp_enet_qos_tx() and returned only by the transmit-completion interrupt handler tx_dma_done(). A frame that h…
-
Medium 5.5
Memory-mapped thread stack is never unmapped when a thread is aborted by another thread, exhausting kernel virtual address space
When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, each thread stack is mapped into the kernel virtual address space with a guard page on either side, and the mapping is released during abort cleanup. k_thread_abort_cleanup() in kernel/thread.c has two paths: a …
-
Medium 4.6
NULL pointer dereference in the Zephyr USB host stack when a device reports zero configurations
usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises bNumConfigurations == 0, but it only logs the error and jumps to the cleanup label without setting the return code. At that point the local err is still 0 …
-
Medium 4.6
Renesas RA SCI UART driver: unacknowledged receive-error interrupt causes a permanent interrupt storm and CPU lockup
The Renesas RA SCI UART driver's receive-error ISR, uart_ra_sci_eri_isr() in drivers/serial/uart_renesas_ra_sci.c, acknowledged the error condition only when a Zephyr interrupt-driven callback had already been registered. With CONFIG_UART_INTERRUPT_DRIVEN=y a…
-
Medium 5.3
Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated attacker can request a…
-
Medium 5.3
A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin._from_p…
-
Medium 4.8
Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without…
-
Medium 6.5
AsyncSSH: SFTP Recursive Copy Path Traversal via Unsanitized Server-Supplied Filenames
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient._copy() in asyncssh/sftp.py, reache…
-
Medium 6.3
Turboderp-org ExLlamaV3 hash-MoE routing routing.cu routing_sel_norm_kernel out-of-bounds
A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2ei…