Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
56 results · Clear filters · Feed
-
Critical 9.8
VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx
VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no au…
-
Critical 9.1
Tactical RMM 0.17.0 through 1.6.1 Arbitrary File Read via Report Preview
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permi…
-
Critical 9.2
Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability t…
-
Critical 9.3
NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to …
-
Critical 9.3
A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free accou…
-
Critical 9.2
C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell com…
-
Critical 9.2
C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell…
-
Critical 9.2
C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious pe…
-
Critical 9.4
OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning
OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a…
-
Critical 9.3
Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container
The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesyst…
-
Critical 9.8CVE-2026-129110 Public exploit
sysPass 3.0.1 through 3.2.11 Unauthenticated Reinstallation RCE via install/install
sysPass 3.0.1 through 3.2.11 contains an authentication bypass vulnerability that allows unauthenticated attackers to reinstall an already-installed instance by POSTing to the install/install handler, which never checks isInstalled(). Attackers can overwrite …
-
Critical 9.1
Dell PowerStore contains an OS Command Injection vulnerability. An authenticated user with limited privileges could pot…
-
Critical 9.3
RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vu…
-
Critical 9.3
WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.
-
Critical 9.3
WordPress WP BASE Booking plugin <= 6.5.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6…
-
Critical 9.9
WordPress Hotel Booking Lite theme <= 2.5.1 - Arbitrary File Upload vulnerability
Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: from n/a through 2.5.1.
-
Critical 9.8
WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.9 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: fr…
-
Critical 9.8
PLANET GS-5220-8P2T2S Stack Buffer Overflow via webstax_auth Cookie
PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008 contains a stack-based buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by submitting an oversized webstax_auth HTTP Cookie value th…
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so th…
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to …
-
Critical 9.1
SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, a…
-
Critical 9.3
NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to …
-
Critical 9.2
NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-…
-
Critical 9.1
NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens becau…
-
Critical 9.8
Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure
Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's telemetry setting, and some events include more detail than needed. During normal use, with no user action, values such as leave type names, c…
-
Critical 9.4
Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos…
-
Critical 9.2
Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that u…
-
Critical 9.1
Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload
Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing bi…
-
Critical 9.8CVE-2026-119077 Public exploit
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form s…
-
Critical 9.8
Chatterbug Forms <= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission
The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file exten…
-
Critical 9.1
OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization
OpenEMR before 8.4.0 contains OAuth scope canonicalization and containment flaws that allow unauthenticated attackers to obtain unapproved system-level FHIR access. Attackers can register a colon-form system:Patient.read client that bypasses approval, then re…
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to …
-
Critical 9.9
OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest
OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain Kubernetes cluster-admin rights by submitting unrestricted manifests through the Additional Manifest feature. Attackers can deploy a ClusterRoleBin…
-
Critical 9.1
OpsTree BuildPiper before 2.7.0 lacks rate limiting on password-reset OTP verification, allowing unauthenticated attack…
-
Critical 9.9
OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes
OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define Hos…
-
Critical 9.2
FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli…
-
Critical 9.1
FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof…
-
Critical 9.3
FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that …
-
Critical 9.4
OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerab…
-
Critical 9.1
listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP v…