Archive
12 November 2026
Vulnerabilities first published on this day (UTC), newest first.
152 results · Clear filters · Feed
-
Medium 4.7
Heap overflow via oversized RSA signature in GCP KMS signing callback
A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the libra…
-
Medium 6.3
A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/cor…
-
Medium 5.3
A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsA…
-
Medium 6.9
@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override co…
-
Medium 4.8
@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without group…
-
Medium 5.4
Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 un…
-
Medium 6.3
Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /_image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose pa…
-
Medium 6.5
Vault vulnerable to ACL deny bypass via trailing slash
Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration pa…
-
Medium 5.9
Vault integrated storage join may disclose server environment credentials
HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environme…
-
Medium 5.3
OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trac…
-
Medium 5.3
Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in…
-
Medium 5.3
Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that all…
-
Medium 5.3
Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount() can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to …
-
Medium 5.3
Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('form') uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal param…
-
Medium 5.3
Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf() limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium h…
-
Medium 4.8
Addressable URI normalization resolves some dotted path segments to the wrong path
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a differ…
-
Medium 5.9
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.…
-
Medium 5.9
Addressable: Regular Expression Denial of Service in Addressable templates with multiple variables
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressio…
-
Medium 5.9
Addressable: Denial of service in URI path normalization
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing …
-
Medium 5.9
Addressable: Regular Expression Denial of Service in Addressable templates with certain exploded expressions
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators g…
-
Medium 4.3
Addressable display_uri can show misleading hosts with invalid Punycode A-labels
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them uncha…
-
Medium 6.5
MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Route
MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store_owner role possessing th…
-
Medium 5.9
basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF
basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without …
-
Medium 5.3
basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()
basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved proper…
-
Medium 5.4
@hono/node-server: WebSocket upgrade request-target starting with `//` replaces the host in `c.req.url`, bypassing `Origin` checks
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the requ…
-
Medium 5.3
@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. I…
-
Medium 5.3
@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator a…
-
Medium 4.0
Xiaomi Mi Browser < 14.66.0 Path Traversal via ThirdDocViewerActivity
Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized …
-
Medium 5.3
Loofah allowed_uri? treats javascript: alert(1) as safe
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.3, Loofah::HTML5::Scrub.allowed_uri? strips whitespace and control characters before decoding a semicolon-less num…
-
Medium 4.7
Loofah: SVG `<textPath>` and `<mpath>` bypass local-reference restriction
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah's SVG_ALLOW_LOCAL_HREF safelist lists textPath with lowercase spelling that does not match the HTML5 parser's ele…
-
Medium 4.7
Loofah: CSS url() sanitization bypass via escaped parentheses
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, Loofah::HTML5::Scrub.scrub_css checks only the first parse of a style attribute, then rebuilds CSS with identifier escap…
-
Medium 5.3
Loofah allowed_uri? treats data:text/html as safe text/plain
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. In 2.25.2, Loofah::HTML5::Scrub.allowed_uri? treats a data URI mediatype containing the HTML5 named solidus reference / as malformed …
-
Medium 5.4
Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actions
Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and n…
-
Medium 6.9
Image CAPTCHA for Contact Form 7 and WPForms through 3.3.29 contains a CAPTCHA bypass vulnerability that allows unauthe…
-
Medium 5.3
Loofah: Regular expression denial of service in the SVG local-reference check
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.3, the Loofah HTML5 sanitizer checks href and xlink:href on elements in SVG_ALLOW_LOCAL_HREF with a regular expression whos…
-
Medium 4.3
Foreman: authorization flaw in the foreman::controller::useraware handling used by api::v2::sshkeyscontroller
A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the…
-
Medium 4.3
Foreman: authorization flaw in the mail-notification endpoints implemented by api::v2::mailnotificationscontroller
A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(par…
-
Medium 5.9
Dixell/Copeland XWEB EVO Authentication Bypass via users.lua
XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password ac…
-
Medium 6.5
BACnet Stack: Client-Side Out-of-Bounds Read in AtomicReadFile-ACK Record-Access Handling via RecordCount / fileData[] Mismatch
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a client-side out-of-bounds read in the AtomicReadFile-ACK record-access handling path. The issue is caused by a mismatch between a…
-
Medium 5.3
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4…