Archive
12 November 2026
Vulnerabilities first published on this day (UTC), newest first.
24 results · Clear filters · Feed
-
Low 2.7
Vault audit device prefix vulnerable to log injection
Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentia…
-
Low 2.3
Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js
Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote…
-
Low 2.3
Astro: Reflected XSS via unescaped slot names in @astrojs/svelte
Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote co…
-
Low 2.3
Astro: XSS via attribute injection in dynamic tag names
Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attribut…
-
Low 3.4
Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the …
-
Low 3.1
Addressable display_uri can show misleading hosts containing bidi and invisible characters
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control…
-
Low 3.1
Tornado: Open redirect via triple-slash redirect paths
Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable t…
-
Low 1.0
Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly …
-
Low 3.7
express-rate-limit skipFailedRequests / skipSuccessfulRequests: with the default MemoryStore, a request from an earlier window is still un-counted from the current window
express-rate-limit is a basic rate-limiting middleware for Express. From 8.6.0 until 8.7.2, the built-in MemoryStore returns a Client whose mutable resetTime object is retained by middleware using skipFailedRequests or skipSuccessfulRequests. When a later req…
-
Low 3.1
pgEdge Postgres MCP Server custom tools performed writes without user confirmation
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking onl…
-
Low 2.3
The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output …
-
Low 2.4
Docker Sandboxes restores removed automatically assigned port publications
Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox resta…
-
Low 3.3
The user-mode system call verifier z_vrfy_charger_get_prop() in drivers/charger/charger_handlers.c declares an uninitia…
-
Low 3.7
PostgreSQL pg_basebackup can use backup manifest content as a format string
Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read byt…
-
Low 3.1
PostgreSQL foreign key and JSON conversions bypass EXECUTE privilege on cast functions
Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database…
-
Low 3.8CVE-2026-120490 Public exploit
On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules ca…
-
Low 3.3
Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures
-
Low 2.7
Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets modu…
-
Low 3.9
Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory
A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). Whe…
-
Low 1.9
A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML …
-
Low 3.3CVE-2026-113408 Public exploit
Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository
-
Low 3.1
Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to by…
-
Low 3.8
Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and…
-
Low 3.8
Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability
Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged c…