Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
318 results · Clear filters · Feed
-
High 8.1
Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially…
-
High 7.5
In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration exampl…
-
High 8.8
Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (ua…
-
High 8.8
Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerabil…
-
High 8.8
OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the…
-
High 7.7
In Eclipse AAS4J before 3.0.1, `XmlSchemaValidator.validateSchema()` (and `AASXValidator.validateSchema()`, which calls…
-
High 8.5
A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server be…
-
High 7.1
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository …
-
High 8.5
A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland b…
-
High 7.2
Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerabi…
-
High 7.1
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository …
-
High 8.8
Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. An authenticated user with limited privile…
-
High 7.1
Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impe…
-
High 7.1
RPC session pool exhausted by unfinished fragmented requests
P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID, without a timeout, when the rest of the request never arrives. A session that does not get an Application Relationship is also kept after the…
-
High 7.2
Out-of-bounds write with too many MCR blocks in a Connect request
P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNET_MAX_MC_CR, 1 by default). Each further block is written past th…
-
High 7.1
P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and star…
-
High 7.1
P-Net before 1.0.4 routes a received RTA alarm frame to an Application Relationship using only the destination alarm re…
-
High 7.0
TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus Package Installer
Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü Pardus Package Installer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pardus Package In…
-
High 8.3
Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could …
-
High 8.8
Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrat…
-
High 7.5
KVStoreInterpreter::verify_signature_legacy answers true for every token and every key
`KVStoreInterpreter::verify_signature_legacy(&PushDrop, &PublicKey)`, public and deprecated since 0.2.0 (the crate's first release), read neither argument and answered `true`. A KVStore token signed by nobody, a signed token checked against a key other than i…
-
High 8.2
frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect
In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of g…
-
High 7.8
X.Org Server XvQueryImageAttributes Negative Size Reply
A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.
-
High 8.7
Multiple Vulnerabilities in OpenKM Community Edition
Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower la…
-
High 8.3
Multiple Vulnerabilities in OpenKM Community Edition
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote atta…
-
High 8.3
Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to ex…
-
High 8.6
Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration …
-
High 8.3
Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via t…
-
High 8.1
Zipline through 4.3.2 Path Traversal via x-zipline-filename Header
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or…
-
High 8.6
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execut…
-
High 8.2
Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS…
-
High 7.5
Cudy TR3000 before 2.5.42 Unauthenticated RCE via mDNS Automesh Broker Adoption
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycm…
-
High 8.7
Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP…
-
High 7.4
Cudy TR3000 before 2.5.42 Curl Argument Injection via TR-069 Upload
Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add opt…
-
High 8.6
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execut…
-
High 7.2
Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call…
-
High 8.3
SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve…
-
High 7.2
Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload
Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.ex…
-
High 7.5
SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords
SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod…
-
High 7.7
NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read
NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers r…