Archive
11 November 2026
Vulnerabilities first published on this day (UTC), newest first.
692 results · Feed
-
Medium 5.3
H3C ICG2000 Unified Communication Gateway Web Management check.j missing authentication
A flaw has been found in H3C ICG2000 Unified Communication Gateway 2023. This issue affects some unknown processing of the file /wnm/check.j of the component Web Management Module. Executing a manipulation can lead to missing authentication. The attack may be…
-
Medium 4.4
Moonshot AI Kimi Code WorkspaceDirsService local.toml reliance on untrusted inputs in a security decision
A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on…
-
Low 3.7
Zipline before 4.8.0 maxViews Limit Bypass via Race Condition
Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the …
-
Medium 6.5
Zipline 4.3.2 before 4.8.0 Rate Limit Bypass via Spoofed X-Forwarded-For
Zipline 4.3.2 before 4.8.0 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade throttling by spoofing X-Forwarded-For headers when core.trustProxy is enabled. Attackers can send a different X-Forwarded-For value per reque…
-
Medium 4.3
Zipline 4.0.0 before 4.8.0 Disabled Extensions Upload Filter Bypass via Extension Format Mismatch
Zipline 4.0.0 before 4.8.0 contains an upload filter bypass vulnerability that allows users with upload access to store blocked file types due to extension format mismatch. The upload and partial handlers compare dotted, case-sensitive extensions against undo…
-
Medium 4.3
Zipline 4.6.2 before 4.8.0 Disabled MIME Type Policy Bypass via File Metadata Update
Zipline 4.6.2 before 4.8.0 contains a policy bypass vulnerability that allows authenticated users to evade administrator-disabled MIME types by editing file metadata. Attackers can upload a permitted file, then set a disabled type such as text/html through PA…
-
Medium 4.3
Moonshot AI Kimi Code Web UI index-HU0LCM-X.js isOriginAllowed redirect
A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin lead…
-
Medium 4.3
Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data …
-
High 8.8
Use after free in Elements in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging social engineer…
-
High 8.8
Out of bounds read in Media in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute ar…
-
High 8.8
Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.78 allowed a remote attacker leveraging soci…
-
Low 3.1
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the re…
-
High 7.5
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker w…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary…
-
High 8.8
Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary …
-
Low 3.4
Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised…
-
Medium 6.8
Missing authorization in ImageCapture in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had comprom…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary…
-
High 8.8
Use after free in PDF in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code insid…
-
High 8.8
Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary co…
-
Medium 5.3
Incorrect authorization in SiteIsolation in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacke…
-
Medium 5.9
Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compro…
-
High 7.5
Use of uninitialized variable in Skia in Google Chrome on on Android prior to 157.0.8103.78 allowed a remote attacker w…
-
High 8.8
Out of bounds write in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code i…
-
High 8.8
Out of bounds write in Network in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary c…
-
Low 3.1
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised th…
-
Low 3.1
Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the rend…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside…
-
Medium 4.3
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin dat…
-
High 7.5
Use after free in Core in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromi…
-
High 7.5
Use after free in Dawn in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the render…
-
High 8.8
Buffer overflow in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code…
-
High 8.8
Type confusion in Turbolev in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code …
-
Medium 4.3
Incorrect authorization in Layout in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-ori…
-
High 8.8
Use after free in MediaStream in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary co…
-
High 8.8
Use after free in Extensions in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker leveraging…
-
Low 3.1
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the re…
-
Medium 4.3
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin…
-
High 8.8
Type confusion in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside…