Archive
9 November 2026
Vulnerabilities first published on this day (UTC), newest first.
241 results · Clear filters · Feed
-
Medium 5.3
Rack: Rack::Static header_rules bypass via dot-segment normalization mismatch
Rack is a modular Ruby web server interface. Prior to 2.2.25, 3.1.23, and 3.2.8, Rack::Static serves a path after Utils.clean_path_info normalization but evaluates header_rules against a path that is only URL-decoded. An unauthenticated attacker can request a…
-
Medium 6.3
braindecode Hub Integration base.py EEGModuleMixin._from_pretrained path traversal
A security vulnerability has been detected in braindecode up to 1.8.2. This affects the function EEGModuleMixin._from_pretrained of the file braindecode/models/base.py of the component Hub Integration. Such manipulation of the argument filename leads to path …
-
Medium 4.8
Rack: Rack::Request#host_with_port (and #base_url / #url) return the raw invalid Host header — incomplete fix of CVE-2026-34835
Rack is a modular Ruby web server interface. From 3.0 until 3.1.23 and 3.2.8, Rack::Request#host_with_port, #base_url, and #url can return an attacker-controlled invalid authority from Host, X-Forwarded-Host, or Forwarded: host= verbatim. Applications without…
-
Medium 6.5
AsyncSSH: SFTP Recursive Copy Path Traversal via Unsanitized Server-Supplied Filenames
AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient._copy() in asyncssh/sftp.py, reache…
-
Medium 6.3
Turboderp-org ExLlamaV3 hash-MoE routing routing.cu routing_sel_norm_kernel out-of-bounds
A weakness has been identified in Turboderp-org ExLlamaV3 up to 1.6.3. The impacted element is the function routing_sel_norm_kernel of the file exllamav3/exllamav3_ext/routing.cu of the component hash-MoE routing. This manipulation of the argument gate.tid2ei…
-
Medium 6.3
ModSecurity: HTML decoder missing entities, leading to evasion
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, t:htmlEntityDecode recognizes only a small subset of named HTML entities, so rules that depend on the transformation can…
-
Medium 5.4
ModSecurity: removeComments Transformation Fails to Strip Adjacent Comments, Enabling WAF Rule Bypass
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, msre_fn_removeComments_execute in apache2/re_tfns.c and inplace() in src/actions/transformations/remove_comments.cc impl…
-
Medium 6.5
Wagtail: Improper restriction handling on Page translation API endpoint
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a Wagtail CMS user with the submit translations permission can call the Admin API copy for translation action for a source page that the user cannot…
-
Medium 5.3
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, the Wagtail Documents and Images API V2 excludes directly restricted collections but fails to exclude their descendant collections, even though desc…
-
Medium 6.5
Wagtail: Improper permission handling when copying snippets
Wagtail is an open source content management system built on Django. Prior to 7.0.9, 7.3.4, 7.4.3, and 8.0rc2, a CMS user who has add permission for a snippet model but lacks change and view permission for an existing snippet can access the snippet copy view …
-
Medium 6.4
pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev102, an authenticated non-admin user with the SETTINGS permission can configure WindowsPhoneNotify through /json/save_config by setting pushurl, pushid, and enabled. Wind…
-
Medium 6.4
Relative path traversal in the log export commands in AWS ParallelCluster CLI
The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 objec…
-
Medium 6.9
pympp: Gas Draining with padding
pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the fee_payer, pympp validates calldata using eth_abi decoding, which is lenient about trailing bytes. The FeePayerPolicy caps gas_limit (≤ 2 M) and max_f…
-
Medium 4.3
Dynatrace MCP Server: DQL injection via parameters not documented as DQL
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capabil…
-
Medium 4.2
Dynatrace MCP Server: Workflow template injection via create_workflow_for_notification
Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.0.0, the create_workflow_for_notification tool inserts the caller-controlled teamName, problemType, and channel values into a Dynatrace workflow without neutralizing Jinja2 expressi…
-
Medium 5.3
titra: residual mass assignment via customfields in timeentry/create and project/task/create
titra is an open source time tracking project. In versions 1.0.3 and prior, authenticated API users can abuse the customfields object to inject or overwrite top-level fields in MongoDB documents. At time of publication, there are no publicly known patches.
-
Medium 6.3
Turboderp-org ExLlamaV3 NGramEmbedding ngram.cu ngram_dequant out-of-bounds
A security flaw has been discovered in Turboderp-org ExLlamaV3 up to 1.6.3. The affected element is the function ngram_dequant of the file exllamav3/exllamav3_ext/ngram.cu of the component NGramEmbedding. The manipulation of the argument head_bias results in …
-
Medium 5.3
Nuxt UI: UAuthForm / UForm SSR markup omits `method`, leaking credentials via GET if submitted before hydration
Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.…
-
Medium 5.9CVE-2026-122056 Public exploit
Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service
A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corru…
-
Medium 5.4
A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS …
-
Medium 5.4
This issue was addressed with improved checks. This issue is fixed in HomeView Software Version 27.2, iOS 18.7.12 and i…
-
Medium 5.4
A logic issue was addressed with improved state management. This issue is fixed in HomeView Software Version 27.2, iOS …
-
Medium 6.5
This issue was addressed by removing the vulnerable code. This issue is fixed in HomeView Software Version 27.2, iOS 26…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in HomeView Software Version 2…
-
Medium 4.0
python-tuf: Platform-dependent delegation path matching
python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path author…
-
Medium 5.7
apport: Arbitrary file creation or overwrite via path traversal in base64-encoded problem report keys
In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-…
-
Medium 4.3
Apache Commons Codec: NUL bytes in tree entry names cause Git/SWHID identifier collisions (GitIdentifiers class)
The GitIdentifiers class in Apache Commons Codec did not reject NUL bytes in tree entry names. Because Git uses a NUL byte to mark the end of each entry name in a tree object, a crafted name could make one tree serialize to the same bytes as a different tree.…
-
Medium 6.3
mikefarah yq encoder_properties.go Encode escape output
A vulnerability has been found in mikefarah yq up to 4.53.3. This affects the function Encode of the file pkg/yqlib/encoder_properties.go. Such manipulation leads to escaping of output. It is possible to launch the attack remotely. The pull request to fix thi…
-
Medium 5.3
Temporal Server workflow-history pagination token is not bound to the requested namespace and workflow
Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request…
-
Medium 5.3
FFmpeg through 9.0.2 Heap Out-of-Bounds Read in V4L2 M2M Encoder
FFmpeg through 9.0.2 contains a heap out-of-bounds read vulnerability in v4l2_buffer_swframe_to_buf() in libavcodec/v4l2_buffers.c that mishandles frames with negative linesize. Attackers can supply bottom-up AVI or PNM/PFM files that are transcoded to a V4L2…
-
Medium 5.5
FFmpeg through 9.0.2 CPU Exhaustion via JPEG XL Parser TOC Count
FFmpeg through 9.0.2 contains an uncontrolled resource consumption vulnerability in parse_frame_header() in libavcodec/jpegxl_parser.c that fails to validate TOC entry counts against remaining input. Attackers can supply a crafted JPEG XL frame header with a …
-
Medium 5.3
FFmpeg through 9.0.2 Use-After-Free via NVDEC Stale Bitstream Pointer
FFmpeg through 9.0.2 contains a use-after-free vulnerability in libavcodec/nvdec.c because ff_nvdec_start_frame() fails to reset ctx->bitstream after slice errors. Attackers can supply crafted video that abandons a picture before end_frame, causing cuvidDecod…
-
Medium 4.7
FFmpeg 9.0 through 9.0.2 Memory Exhaustion via LCEVC Enhancement Dimensions
FFmpeg 9.0 through 9.0.2 built with liblcevc_dec fails to validate LCEVC enhanced output dimensions against max_pixels in libavcodec/decode.c before frame allocation. Attackers can supply crafted H.264, HEVC or VVC streams declaring huge LCEVC resolutions to …
-
Medium 6.1
FFmpeg through 9.0.2 SGI Encoder Out-of-Bounds Read via sgienc.c
FFmpeg through 9.0.2 contains an out-of-bounds read vulnerability in the SGI encoder's encode_frame() in libavcodec/sgienc.c, where unsigned size variables mis-handle negative linesize frames. Attackers can supply a video whose display matrix triggers autorot…
-
Medium 4.7
FFmpeg through 9.0.2 Division by Zero via dovi_configure_ext() in dovi_rpuenc.c
FFmpeg through 9.0.2 contains a division by zero vulnerability in dovi_configure_ext() in libavcodec/dovi_rpuenc.c that allows attackers to crash the process via an unvalidated frame rate denominator. Attackers can supply a crafted HEVC or AV1 input with a no…
-
Medium 5.5
FFmpeg through 9.0.2 Division by Zero via VVC ff_vvc_slice_rpl()
FFmpeg through 9.0.2 contains a division by zero vulnerability in the VVC decoder because ff_vvc_slice_rpl() fails to validate num_ref_idx_active against built reference list entries. Attackers can supply a crafted VVC bitstream whose excess reference indices…
-
Medium 5.3
FFmpeg through 9.0.2 Use-After-Free in MJPEG Hardware-Accelerated Decoding
FFmpeg through 9.0.2 contains a use after free vulnerability in libavcodec/mjpegdec.c that allows attackers to trigger freed buffer reads by sending a SOF marker without a preceding SOI. Attackers can supply crafted MJPEG streams causing ff_mjpeg_decode_sof()…
-
Medium 5.3
FFmpeg through 9.0.2 VP9 CBS Superframe Integer Overflow Out-of-Bounds Read
FFmpeg through 9.0.2 contains an integer overflow in cbs_vp9_split_fragment() in libavcodec/cbs_vp9.c that wraps the superframe size check on 32-bit builds. Attackers can supply a crafted VP9 packet with a forged superframe index containing near-2^32 frame si…
-
Medium 4.7
FFmpeg through 9.0.2 VAAPI Memory Leak via Abandoned Picture Buffers
FFmpeg through 9.0.2 contains a memory leak vulnerability in libavcodec/vaapi_decode.c that allows attackers to exhaust memory by supplying streams with slice parse errors. Attackers can craft H.264 or other VAAPI-decoded video where later slices fail to pars…
-
Medium 4.7
FFmpeg through 9.0.2 Assertion Failure DoS via cbs_jpeg_assemble_fragment
FFmpeg through 9.0.2 contains a denial of service vulnerability in cbs_jpeg_assemble_fragment() that miscounts 0xff stuffing bytes in JPEG scan headers. Attackers can supply a crafted JPEG/MJPEG stream with 0xff in the scan header, triggering an av_assert0 ab…