Archive
10 November 2026
Vulnerabilities first published on this day (UTC), newest first.
51 results · Clear filters · Feed
-
Low 3.7
Active Storage: Possible local file disclosure in Active Storage video previews and analysis
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::Vi…
-
Low 2.9
CAI Content Credentials | Incorrect Authorization (CWE-863)
CAI Content Credentials is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploit depen…
-
Low 3.7
CAI Content Credentials | Improper Input Validation (CWE-20)
CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploit dep…
-
Low 3.3
After Effects | Out-of-bounds Read (CWE-125)
After Effects is affected by an out-of-bounds read vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue…
-
Low 3.7
Action Mailbox: Possible signature replay in Action Mailbox Mailgun ingress
Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails. Prior to 8.1.4.1 and 8.0.5.2, the Action Mailbox Mailgun ingress authenticates a request with an HMAC of the timestamp and token parameters concatenated without a sepa…
-
Low 3.1
Action Pack: Missing SameSite attribute on session cookies from Action Pack session stores
Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, Action Pack session stores other than ActionDispatch::Session::CookieStore (CacheStore, MemCacheStore, and third-party stores built on AbstractStore, Abstrac…
-
Low 3.7
fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. Prior to 5.12.0, when the non-default stopNodes option is enabled, readStopNodeData() in OrderedObjParser.js calls readTagExp() for each less-than character…
-
Low 2.0
Nokogiri: Possible Use-After-Free when setting an attribute value via `Nokogiri::XML::Node#[]=` or `#lang=`
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, the CRuby native extension can leave Ruby wrappers pointing to freed memory when Nokogiri::XML::Node#[]= or Nokogiri::XML::Node#lang= replaces an existing attr…
-
Low 2.3
Nokogiri: Mutation XSS through `noscript` content in Nokogiri's HTML5 serializer
Nokogiri is an open source XML and HTML library for the Ruby programming language. From 1.12.0 until 1.19.5, the C extension on CRuby and TruffleRuby has a Nokogiri::HTML5 serializer that does not escape text inside noscript elements or angle brackets inside …
-
Low 3.7
Nokogiri : Possible SSRF on JRuby when resolving external DTDs or entities with `NONET` set
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.5, on JRuby, applications that parse untrusted XML with DTDLOAD, DTDVALID, or NOENT can have the NONET restriction bypassed when an external DTD or entity uses a …
-
Low 2.0
On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Aut…
-
Low 2.0
Winter CMS: Stored XSS through Backend List widget image columns
Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without esca…
-
Low 3.3
In userdata_report of hwcodec_firmware, there is a possible Logic error due to a logic error in the code. This could le…
-
Low 2.3
In getCodecQp of GC2AV1Enc.cpp, there is a possible way to trigger an out of bounds read during quantization table look…
-
Low 3.3
Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the g…
-
Low 2.7
In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via …
-
Low 3.3
In trusty_context_switch of services/spd/trusty/trusty.c, there is a possible Secure world register state leak due to a…
-
Low 2.4
In notifyPollingLoopFrames of hal_fwlog.cc, there is a possible way to trigger an out of bounds read and write when for…
-
Low 3.3
In decode of fw_vp9_dec_pic.c, there is a possible Logic error due to a logic error in the code. This could lead to loc…
-
Low 2.3
In multiple functions of simd_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to…
-
Low 2.3
In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a…
-
Low 3.3
In get_sswrp_state of cpm_mbox_srv/main.c, there is a possible Logic error due to a logic error in the code. This could…
-
Low 2.9
In bytes_are_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information di…
-
Low 2.3
In smmu_domain_config_s1 of arm-smmu-v3.c, there is a possible way to access stale stream table entries across reassign…
-
Low 3.3
In register_dump_dpa of sswrp_pcie.c, there is a possible Logic error due to a logic error in the code. This could lead…
-
Low 2.3
In multiple locations, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local i…
-
Low 2.3
In ac_get_prot_config of plat_trusty.c, there is a possible memory corruption due to improper input validation. This co…
-
Low 2.3
In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle du…
-
Low 2.3
In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via sig…
-
Low 2.3
In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-…
-
Low 3.3
In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to lo…
-
Low 3.3
Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by…
-
Low 3.7
Forge: Ed25519 signature verification accepts small-order public keys
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical encodings. With S = 0 …
-
Low 3.3
Data Deduplication Security Feature Bypass Vulnerability
Improper authorization in Data Deduplication allows an authorized attacker to bypass a security feature locally.
-
Low 3.3
Windows Language Experience Service Tampering Vulnerability
Weak authentication in Windows Language Experience Service allows an authorized attacker to perform tampering locally.
-
Low 2.0
Incorrect calculation of buffer size in the MigTD's servtd_get_quote for the Intel(R) TDX Migration Trust Domain (MigTD…
-
Low 3.4
Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had c…
-
Low 2.3
compose-lint: A symlink in a pull request can issue workflow commands through the compose-lint Action's SARIF-directory error message
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From version 0.30.0 until 0.32.0, the compose-lint GitHub Action prints the resolved directory from a failed sarif-file subdirectory creation witho…
-
Low 2.3
compose-lint: Text in a pull request can reach Azure Pipelines as logging commands through compose-lint 0.31.0's output
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint does not neutralize the Azure Pipelines ##vso[ logging-command opener on any output path. A pull request can place …
-
Low 2.3
compose-lint: A file path in a pull request can issue CI workflow commands through compose-lint 0.31.0's command-line error messages
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. In version 0.31.0, compose-lint's argument parser writes rejected repository paths to stderr without the output sanitizer when a path is passed wit…