Archive
12 November 2026
Vulnerabilities first published on this day (UTC), newest first.
152 results · Clear filters · Feed
-
Medium 4.3
Governikus AusweisApp Mobile StartPAOSResponse cross site scripting
A vulnerability was found in Governikus AusweisApp Mobile up to 2.5.5. This impacts an unknown function of the component StartPAOSResponse Handler. Performing a manipulation of the argument ResultMessage results in cross site scripting. The attack can be init…
-
Medium 5.3
Dixell/Copeland XWEB EVO Information Disclosure via sysinfo.lua
XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the d…
-
Medium 5.9
The Versal™ AI Edge Series Gen 2 Peripheral Protection Unit (XPPU) for the inter-processor interrupt (IPI) buffers does…
-
Medium 6.0
An out-of-bounds read vulnerability in the IOMMU could allow a malicious guest to corrupt hypervisor (HV) pages and pot…
-
Medium 5.9
Improper validation of consistency within input in AMD SEV (Secure Encrypted Virtualization) firmware could allow an at…
-
Medium 6.9
Insufficient parameter sanitization in AMD Secure Processor (ASP) TEE DrvSys could allow an attacker with local access …
-
Medium 5.3
Signal K Server: Buffered logs exposed to unauthenticated WebSocket clients
### Summary An unauthenticated WebSocket client can subscribe to the log path and receive buffered server logs. WebSocket connections are intentionally permitted before authentication because login occurs over the WebSocket connection. However, the log subscr…
-
Medium 6.8CVE-2026-0101 Public exploit
Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local at…
-
Medium 5.7
A transient execution vulnerability in some AMD processors may allow an attacker with the ability to execute code on th…
-
Medium 5.9
Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access c…
-
Medium 6.9
Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver c…
-
Medium 5.3
Unverified ownership of the default EMR cluster log location in AWS SDK for pandas
Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remed…
-
Medium 5.5
Rust Driver public Client Debug output exposes CSFLE KMS master-key material
A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service credential material in its diagnostic formatting output without redaction. An application that records or displays this formatted output may…
-
Medium 5.4
code16/sharp: Server-side request forgery through an unanchored autocomplete endpoint check
### Impact An authenticated attacker can call the Autocomplete API with the configured endpoint as a substring to request another server-side route. ### Patches The problem has been patched in 9.23.0 and pre-release version 10.0.0-beta.4. The regex verifying …
-
Medium 5.4
code16/sharp: Arbitrary class instantiation through the embed_key API parameter
### Impact An authenticated attacker can instantiate any class in the PHP application by using the `embed_key` parameter across multiple API endpoints. The instantiation is performed by the Laravel container. As a result, the `__construct()` method of the cla…
-
Medium 6.0
frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart
In FRRouting, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires, i.e. when a neighbor has stopped accepting data from the router for twice the hold time. The connection is closed, but bgpd still considers the session to b…
-
Medium 6.1
Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.21.0 until 2.25.3, Loofah's HTML5 APIs Loofah.html5_fragment, Loofah.html5_document, and the scrub_html5_* methods can emit saniti…
-
Medium 6.1
A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS Meridia…
-
Medium 6.3
The Symfony FrameworkBundle framework.trusted_proxies option and the HttpFoundation Request::setTrustedProxies() method…
-
Medium 5.1
Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8
Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file` form parameter could bypass the intended server-file selection restrictions and move files from outside the permitted selection directory or a…
-
Medium 5.4
An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and…
-
Medium 6.9
Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1
Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted …
-
Medium 6.9
Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1
Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated visitor can cause a site module to be rendered regardless of the Joomla access level that module is restricted to, which dis…
-
Medium 6.9
Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1
Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can read the online version of campaigns that were never made public, including campaig…
-
Medium 5.1
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1
Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.1 - On a default configuration, an attacker can craft a link on the affected site that redirects the visitor to an arbitr…
-
Medium 5.5
Sssd: sssd: null pointer dereference in pam responder when protocol version negotiation is skipped
A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication.…
-
Medium 5.5
Sssd: sssd: local denial of service through unchecked oauth2 json code type in pam responder
A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, t…
-
Medium 5.9
Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion
A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized …
-
Medium 6.3
Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server wi…
-
Medium 6.5
Grafana is an open-source platform for monitoring and observability. When an Elasticsearch data source is configured wi…
-
Medium 5.3
A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other …
-
Medium 6.8
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible c…
-
Medium 5.5
Cpio: cpio: stack-based buffer overflow in write_out_tar_header() with long usernames/groupnames
A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copie…
-
Medium 5.3
Awx: unauthenticated debug endpoints trigger scheduler operations
A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=…
-
Medium 5.3
Soup Sieve: Uncontrolled recursion in CSS parser lets nested pseudo-class selectors exhaust the Python call stack
Soup Sieve is a CSS selector library for Beautiful Soup. From 0.4 until 3.0, deeply nested CSS pseudo-class selectors can cause recursive parsing to exceed Python’s recursion limit and raise RecursionError . Applications accepting untrusted selectors may exp…
-
Medium 6.3
Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.10, matching a developer-authored selector that places the general sibling combinator inside :has() repeatedly scans each candidate element's following siblings when th…
-
Medium 6.5
[Node.js Driver] OIDC ENVIRONMENT confusion bypasses ALLOWED_HOSTS and leaks human-callback bearer tokens
The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication. A bearer token produced by the embedding application's own login callback may therefore be transmitted to a host outside the configured set of …
-
Medium 5.3
Soup Sieve: Quadratic-time denial of service when matching `:has()`
Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 4.0.1, Soup Sieve repeatedly searches descendant subtrees for each candidate evaluated by :has() and repeatedly reevaluates a parent containing :has(> ...) for each child…
-
Medium 5.1
AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace …
-
Medium 5.3
MLflow < 3.18.0 Path Traversal via model_id in log_outputs API
MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious model_id parameter to the log outputs API. Attacke…