Archive
9 November 2026
Vulnerabilities first published on this day (UTC), newest first.
241 results · Clear filters · Feed
-
Medium 4.7
FFmpeg through 9.0.2 NULL Pointer Dereference in MPEG Audio Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in mp_decode_frame() in libavcodec/mpegaudiodec_template.c because init_get_bits() failure is ignored after a signed integer overflow. Attackers can pass an oversized packet to the mp3adu …
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference in EA TQI Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tqi_decode_frame() in libavcodec/eatqi.c, which ignores init_get_bits() failure after an integer overflow. Attackers can supply a crafted EA file with a pIQT chunk carrying a 2^28-byte …
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference in Bink Video Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Bink video decoder because decode_frame() in libavcodec/bink.c ignores init_get_bits() failure. Attackers can supply a crafted Bink file with a frame of about 2^28 bytes, overflowin…
-
Medium 4.7
FFmpeg through 9.0.2 NULL Pointer Dereference via Motion Pixels Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Motion Pixels decoder because mp_decode_frame() ignores init_get_bits() failure. Attackers supplying a roughly 2^28-byte packet through the libavcodec API overflow the bit count, ca…
-
Medium 5.5
FFmpeg through 9.0.2 VBLE Decoder NULL Pointer Dereference via vble_decode_frame()
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in vble_decode_frame() in libavcodec/vble.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435452-byte VBLE frame, causi…
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference via TGV Decoder eatgv.c
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in tgv_decode_inter() in libavcodec/eatgv.c that ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted EA file with a kVGT frame followed by an fVGT inter fr…
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference in CLJR Video Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in the Cirrus Logic AccuPak (CLJR) decoder in libavcodec/cljrdec.c because decode_frame() ignores init_get_bits() failure. Attackers can supply a crafted AVI file with a 2^28-byte CLJR fra…
-
Medium 5.5
FFmpeg through 9.0.2 NULL Pointer Dereference in G.726 ADPCM Decoder
FFmpeg through 9.0.2 contains a NULL pointer dereference vulnerability in g726_decode_frame() in libavcodec/g726.c because it ignores init_get_bits() failure on oversized packets. Attackers can supply a crafted AVI file with a 268435392-byte G.726 audio chunk…
-
Medium 6.5
Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that tri…
-
Medium 6.5
Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointe…
-
Medium 6.5
Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failure
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a …
-
Medium 5.3
Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via…
-
Medium 5.3
Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failure
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSE…
-
Medium 6.8
SuperTokens Core: A session created concurrently with account unlink survives the unlink
SuperTokens Core is an open source authentication server. From 7.0.0 until 11.0.9, 11.1.4, 11.2.4, 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, createNewSession can resolve a primary user before unlinkAccounts detaches a login method and then insert t…
-
Medium 5.3
ION-DTN 2.1.0-4.2.0 Heap Buffer Under-allocation DoS in amsd
NASA JPL ION-DTN 2.1.0 through 4.2.0 contains a heap buffer under-allocation vulnerability in the Asynchronous Message Service daemon (amsd) that allows a rogue or misconfigured peer to trigger an out-of-bounds write by sending crafted Meta-AMS (MAMS) configu…
-
Medium 6.5
rConfig Core 8.2.3 < 8.2.13 Cleartext Credential Exposure via API
rConfig Core 8.2.3 before 8.2.13 contains an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices through the device-credentials API due to automatic decryption on rea…
-
Medium 5.5
Gst-plugins-good: gst-plugins-good: qtdemux out-of-bounds heap read from invalid uncompressed video layout
A flaw was found in GStreamer's gst-plugins-good MOV/MP4 demuxer. When processing an uncompressed video track, qtdemux fails to validate the declared row alignment and chroma geometry before using them to build a video buffer layout. A crafted file can cause …
-
Medium 6.5
Gst-plugins-base: gst-plugins-base: quadratic regex processing in srt/webvtt subtitle parser causes denial of service
A flaw was found in the SRT and WebVTT subtitle parser in GStreamer's gst-plugins-base. While sanitizing inline subtitle markup, the parser repeatedly searches the remaining text with unanchored regular expressions. A crafted subtitle cue with a long line of …
-
Medium 6.5
WordPress WP Activity Log plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7.
-
Medium 6.7
Ansible-core: ansible-core: ansible.builtin.git invokes git without a `--` separator, allowing argument injection via a `-`-leading repository url (e.g. --upload-pack) -> rce
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as…
-
Medium 4.3
Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web workers (denial of service)
A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation ti…
-
Medium 6.2
receive_sharing_intent 1.4.1-1.9.0 Path Traversal via FileDirectory
The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the inte…
-
Medium 5.1
compose-lint: `fix --apply` can delete a line the user did not select, including a security setting
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.9.0 until 0.18.0, compose-lint's YAML parser recognizes lone carriage returns and Unicode line separators U+0085, U+2028, and U+2029 as line…
-
Medium 5.3
compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing G…
-
Medium 4.3
WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerability
Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2.
-
Medium 6.3
Folder Permission Bypass in Progress WS_FTP Server
Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.
-
Medium 6.5
FTP Quota Accounting Bypass in Progress WS_FTP Server
Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service.
-
Medium 6.9
Disabled TLS Certificate Validation Enables MITM Attacks
The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.
-
Medium 6.7
CVE-2026-121690
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of th…
-
Medium 5.4
Time-of-check time-of-use (TOCTOU) race condition in Sandisk Dashboard Installer
A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated i…
-
Medium 6.6
Hardcoded AES Key Enables Credential Disclosure
The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.
-
Medium 5.4
PrestaShop Performance Debug Configuration PHP Code Injection
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is…
-
Medium 6.3
`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging …
-
Medium 4.7
kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload
A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remote…
-
Medium 6.3
PipraPay Admin Panel pp-functions.php deleteData sql injection
A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql …
-
Medium 4.8
pdfmake < 0.3.14 Shared Cache Access Policy Bypass
pdfmake before 0.3.14 contains a shared resource caching vulnerability that allows attackers to access cross-document cached resources by exploiting a process-wide virtual file system keyed only by URL without request headers or per-document access enforcemen…
-
Medium 4.8
Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS
-
Medium 5.3
PipraPay pp-token anti-CSRF pp-adapter.php hash_hmac hard-coded credentials
A weakness has been identified in PipraPay 3.0.0. Affected by this vulnerability is the function hash_hmac of the file pp-content/pp-include/pp-adapter.php of the component pp-token anti-CSRF Handler. Executing a manipulation can lead to hard-coded credential…
-
Medium 5.3
AshAi sends unrecognized tool errors verbatim to MCP clients and the model, disclosing internal details
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai allows a caller of an AshAi tool to read internal error details, including module names and data values, by making a tool call fail. AshAi.ToToolError gained an i…
-
Medium 6.5
Gstreamer1-plugins-bad-free: gst-plugins-bad: use of uninitialized gsth265hrdparams in gst_h265_parse_vps() multi-hrd workaround loop
A flaw was found in GStreamer's gst-plugins-bad package. A use of uninitialized memory vulnerability exists in the H.265 (HEVC) bitstream parser when processing Video Parameter Sets that declare more than one HRD (Hypothetical Reference Decoder) parameter set…