Archive
11 November 2026
Vulnerabilities first published on this day (UTC), newest first.
41 results · Clear filters · Feed
-
Low 3.7
Zipline before 4.8.0 maxViews Limit Bypass via Race Condition
Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the …
-
Low 3.1
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the re…
-
Low 3.4
Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised…
-
Low 3.1
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised th…
-
Low 3.1
Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the rend…
-
Low 3.1
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the re…
-
Low 3.1
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the re…
-
Low 3.1
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised th…
-
Low 3.1
Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had…
-
Low 3.1
Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the…
-
Low 3.1
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised th…
-
Low 3.3
ClickMigrate has Path Traversal in "revision -m" argument
ClickMigrate is a database migration tool for ClickHouse with automatic SQL migration management and version tracking. Prior to version 1.0.3, a path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument…
-
Low 3.8
A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiMa…
-
Low 3.5
blueprintUE Self-Hosted Edition before 4.3.6 Arbitrary Iframe Embedding via PeerTube Matcher
blueprintUE Self-Hosted Edition before 4.3.6 contains an iframe injection vulnerability that allows authenticated users to embed arbitrary third-party content by abusing the PeerTube video URL matcher in BlueprintService::findVideoProvider(). Attackers can se…
-
Low 1.1
Checkov by Prisma Cloud: Server-Side Request Forgery Vulnerability
A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unauthorized network requests from host to internal services.
-
Low 1.3
PAN-OS: GlobalProtect Authorization Bypass Vulnerability
An authorization bypass vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated attacker with valid GlobalProtect credentials to bypass IP address restrictions and circumvent network access controls that rely…
-
Low 1.7
PAN-OS: Buffer Overflow Vulnerability in Protocol and Service Processing
A buffer overflow vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker to disrupt service processing by causing a service process crash or memory corruption. Panorama and Prisma® Access are not affected by this vulnerability.
-
Low 2.3
PAN-OS: Privilege Escalation Vulnerability in GlobalProtect
A privilege escalation vulnerability in the GlobalProtect gateway of Palo Alto Networks PAN-OS® software enables an authenticated, lower-privileged user to obtain the privileges and configuration of a higher-privileged user. Cloud NGFW and Panorama are not af…
-
Low 2.7
PAN-OS: User Impersonation through GlobalProtect Portal
Authentication bypass vulnerabilities in the GlobalProtect™ portal and gateway of Palo Alto Networks PAN-OS® software enables an unauthenticated user to bypass security restrictions and establish an unauthorized VPN connection. Panorama, Cloud NGFW, and Prism…
-
Low 3.5
Icinga Web 2: Open redirect on login page, under certain circumstances
Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipu…
-
Low 2.9
An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is b…
-
Low 2.5
A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process i…
-
Low 3.7
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prio…
-
Low 3.1
Probo: Broken access control in public e-signature API
Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes acceptElectronicSignature and recordSigningEvent, both gated only by @auth…
-
Low 3.7
Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability that may permit the use of de…
-
Low 3.7
Double free after allocation failure in regcomp and regexec
The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched. The re_dfa_add_node (the NFA node tab…
-
Low 3.1
Apache Roller: Disabled accounts can sign in through OpenID
Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled to sign in again through OpenID and read unpublished entries. The OpenID sign-in path did not check whether the account was enabled. Only si…
-
Low 3.7
Apache Roller: Unpublished entries remain readable through search after AtomPub unpublish
Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index…
-
Low 3.1
Apache Roller: Unpublished entries of other weblogs readable through preview
Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previe…
-
Low 3.7
Event Tickets < 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST API
The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.
-
Low 2.2
Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Structured Data Modification of Other Users' Posts via IDOR
The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has g…
-
Low 2.7
Smush < 4.3.6 - Author+ Optimization and Restoration of Others' Attachments via IDOR
The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments own…
-
Low 2.7
Dynific Addons for Elementor 1.3 - Contributor+ Arbitrary Post Content Disclosure via dynific_template Shortcode
The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contribu…
-
Low 3.7
Download Manager (Free & Pro) - Unauthenticated Missing Authorization via Password Validation
The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify a package's configured role restriction when validating a package password, allowing an unauthenticated user who knows the password of a role-r…
-
Low 3.7
Download Manager (Free & Pro) - Unauthenticated Protected File Download via Media Preview Download Key
The Download Manager WordPress plugin before 3.3.73, Download Manager WordPress plugin before 7.6.2 does not verify that a visitor is allowed to access a package before its media-preview renderers issue a download key for it, allowing unauthenticated visitors…
-
Low 3.8
Code Snippets < 4.1.0 - Admin+ Network-Scoped Snippet Injection via Snippet Import
The Code Snippets WordPress plugin before 4.1.0 does not verify network-level capabilities before honouring a network-scope parameter on its snippet import routes on multisite, allowing an administrator of a single subsite without network-management rights to…
-
Low 3.5
Live Composer < 2.1.24 - Admin+ Stored XSS via Button
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting atta…
-
Low 3.5
Live Composer < 2.1.24 - Admin+ Stored XSS via Icon
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes wh…
-
Low 3.5
Live Composer < 2.1.24 - Admin+ Stored XSS via Staff
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its staff member settings before outputting them in pages, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even …
-
Low 3.5
Live Composer < 2.1.24 - Admin+ Stored XSS via Social
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks…