Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
318 results · Clear filters · Feed
-
High 7.1
NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to …
-
High 8.7CVE-2026-126274 Public exploit
NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog
NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped i…
-
High 8.2
NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a…
-
High 7.1
NocoDB before 2026.09.0 IDOR in Row Comment Operations
NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read priva…
-
High 8.7
NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attacke…
-
High 7.5
NocoDB before 2026.08.1 Password Reset Token Race Condition
NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt h…
-
High 7.1
NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation …
-
High 8.8
NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens
NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete reco…
-
High 8.0
NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update
NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read…
-
High 8.1
NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue
NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted…
-
High 8.3
NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run…
-
High 8.8
NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query
NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email w…
-
High 7.1
NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversi…
-
High 7.5
Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login
Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remembe…
-
High 7.5
NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form
NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by …
-
High 8.7
NLTK: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan
NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates …
-
High 7.5
NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring
NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, trigge…
-
High 8.7
NLTK: Symlink escape in YCOECorpusReader lets a psd/pos directory symlink read files outside the corpus root within the data sandbox
NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and t…
-
High 7.5
NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()
NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short…
-
High 8.5
EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base art…
-
High 7.5
Nezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation Flaws
Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities that allow members or unauthenticated attackers to abuse NAT, DDNS, OAuth, cron, and server transfer features. Attackers can claim undeclar…
-
High 8.0
EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment
EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an admi…
-
High 8.7
The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, an…
-
High 7.6
OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated …
-
High 8.7
OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials
OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request t…
-
High 7.6
OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain…
-
High 8.8
Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation
Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that create records in bulk for a list of employees. An authenticated user with create permission on the affected record type, such as HR User, can…
-
High 8.8
Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint
Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users to read company details outside their permissions due to a missing permission check. Any logged-in user, including Employee role users, can q…
-
High 7.1
Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view do…
-
High 7.2
Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to bypa…
-
High 8.1
OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php
OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to control patient-matching criteria by supplying a crafted serialized key parameter. Attackers can send serialized arrays to interface/orders/patie…
-
High 8.7
Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP…
-
High 8.8
Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code
Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin users to write server-side templates by bypassing save restrictions. Attackers can upload or rename .tpl files via editor/code upload and rename…
-
High 8.1
Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait
Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename, delete, or overwrite other vendors' digital-asset files in the shared storage/digital_assets directory. Attackers can send rename, delete, or upl…
-
High 7.6
Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding
Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback ser…
-
High 7.5
n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version with known vulnerabilities in its official Docker image, which the Edit Image node uses to process images. Attackers who can supply crafted unt…
-
High 8.2
n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection vulnerability in the MongoDB node's Update and Find And Replace operations due to insufficient validation of the update key value taken from incoming…
-
High 7.5
n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape
n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows authenticated users to escape the sandbox. Attackers with permission to create or modify workflows can craft expressions referencing unexpected …
-
High 8.7
vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face …
-
High 8.2
vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions th…