Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
318 results · Clear filters · Feed
-
High 8.7
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-b…
-
High 7.5
AutoMapper: Uncontrolled Recursion with Constructor Parameters
AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper increments type depth only after creating the destination, so recursive mapping performed through constructor parameters occurs before MaxD…
-
High 7.5
AutoMapper: Denial of Service via uncontrolled recursion that bypasses MaxDepth
AutoMapper is a convention-based object-object mapper in .NET. Prior to 15.1.4 and from 16.0.0 until 16.3.0, AutoMapper can recurse without an effective MaxDepth limit when mapping polymorphic graphs through Include or IncludeBase, runtime-typed object or int…
-
High 8.5
Improper Privilege Management on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
There exists an improper privilege management vulnerability that could cause privilege escalation at the SpaceCom and Space Battery pack SP with WiFi.
-
High 7.0
Inclusion of Web Functionality from an Untrusted Source on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceCom
-
High 7.8
Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header
Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaint…
-
High 7.1
Indico: Local file disclosure through offline-copy path traversal
Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable b…
-
High 7.0
Apache APISIX: Route-level authentication bypass via path normalization mismatch between routing and upstream forwarding
Interpretation Conflict, resulting in (Incorrect Authorization) vulnerability in Apache APISIX. An unauthenticated client can reach upstream paths protected by a route-level auth plugin when a route without auth exists on the same upstream and the upstream do…
-
High 8.4
Dnf5: dnf5daemon-server: dnf5daemon-server: unauthenticated privileged cmdline package fetch/open via add_cmdline_packages
A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local pat…
-
High 8.8
paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, …
-
High 8.7
paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint tha…
-
High 8.7
SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the …
-
High 7.1
SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the…
-
High 7.1
free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the …
-
High 7.4
Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover
Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code …
-
High 8.2
Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview tha…
-
High 8.2
Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code…
-
High 7.1
Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bra…
-
High 7.5
iDentalSoft website information exposure
Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.
-
High 8.5
Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general admini…
-
High 8.7
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticat…
-
High 8.1
Omnispace Agora Project 26.10.0 CSRF via Administrator Account Creation
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF toke…
-
High 7.6
C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-m…
-
High 7.7
C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves…
-
High 7.6
C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attacke…
-
High 7.7
C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicio…
-
High 8.8
C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies
C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send…
-
High 8.4
Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by s…
-
High 7.1
agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remot…
-
High 8.6
MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect …
-
High 8.2
Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters…
-
High 8.2
CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside …
-
High 8.7
BACnet Stack: Remote unauthenticated DoS in `Life_Safety_Zone` `PROP_ZONE_MEMBERS` WriteProperty parsing
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing …
-
High 7.5
BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When rea…
-
High 7.6
Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type. …
-
High 8.6
BACnet Stack: Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffer-overflow in the official router-ipv6 application shipped with bacnet-stack, this results in an out-o…
-
High 7.5
Huatian OA8000 Path Traversal via ntkodownload.jsp
Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory…
-
High 7.5
BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) …
-
High 7.5
BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed…
-
High 8.8
BACnet Stack: Buffer overflows in bsc_node_parse_urls() (BACnet/SC Address Resolution ACK URL parser)
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the bsc_node_parse_urls() function in src/bacnet/datalink/bsc/bsc-node.c contains three distinct bugs when parsing space-separated W…