Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
318 results · Clear filters · Feed
-
High 7.1
OpenEMR before 8.5.0 contains an SQL injection vulnerability that allows authenticated report users to manipulate queri…
-
High 7.2
OpenEMR before 8.5.0 contains a missing authorization vulnerability in portal/import_template.php, where several portal…
-
High 8.7
OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows authenticated users to override system-…
-
High 7.2
OpenEMR before 8.5.0 SQL Injection via IPPF Contraceptive Issue Feature
OpenEMR before 8.5.0 contains a second-order SQL injection vulnerability in the IPPF contraceptive issue feature because issue_ippf_con_save concatenates layout_options field_id values into a REPLACE INTO query as column names. Authenticated administrators ca…
-
High 7.7
OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd
OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where mass-assigned _BitwiseAnd criteria parameters are placed unquoted into SQL with only quote-character escaping. Authenticated portal patient…
-
High 8.3
OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options f…
-
High 7.1
OpenEMR before 8.5.0 Second-Order SQL Injection via dynamic_finder.php
OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users to store malicious SQL via library/ajax/addlistitem.php. Attackers can persist a SQL fragment in the recent_patient_columns option_id value…
-
High 7.1
OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows …
-
High 8.1CVE-2026-126937 Public exploit
Zipline before 4.6.5 TOCTOU Race Condition via /api/setup
Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated attackers to create multiple SUPERADMIN accounts by racing concurrent requests before the firstSetup flag is reset. Attackers can send simultaneo…
-
High 7.1
Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers
Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass chunked-upload size and quota checks by forging Content-Range offsets and totals. Attackers can send tiny chunks to the partial upload endpoint with la…
-
High 8.7
Zipline before 4.5.1 Stored XSS via HighlightCode Component
Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payload…
-
High 8.8
Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints
Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership verification in the PATCH and DELETE handlers for /api/user/folders/:id. Authenticated attackers can supply another user's folder ID to rename it, make…
-
High 7.0
Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that all…
-
High 7.0
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary s…
-
High 8.1
Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login
Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates sessions for a supplied registered credential ID without verifying the assertion. Attackers who obtain a target's passkey credential ID can imper…
-
High 7.1
OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users to read arbitra…
-
High 7.1
OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to create environments on unassigned Kubernetes clusters by tampering with cluster_id and namespaces values. Attackers can modify requests to POST /…
-
High 7.1
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to attac…
-
High 8.3
Huginn before 2026.11.09 contains an information exposure vulnerability in JqAgent that allows authenticated users to r…
-
High 7.3
Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads
Teable before 2026-10-12T12-45-53Z.3331 contains a stored cross-site scripting vulnerability that allows authenticated users to upload SVG or HTML attachments with an attacker-chosen content type. Attackers can send the same-origin /api/attachments/read URL, …
-
High 8.1
2FAuth before 9.0.1 Password Reset Poisoning via Host Header
2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison reset links by forging the HTTP Host header. Attackers can request password or WebAuthn recovery emails with an attacker-controlled host, captu…
-
High 8.8
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contain an authentication bypass vulnerability in SSH public key authentication that reuses cached key authorization decisions across usernames. A…
-
High 7.6
Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, contai…
-
High 7.6
Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API
Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in main/abilitiesregister.php that only require the edit_posts capability. Contributor-level attackers can overwrite, publish, delete, or duplica…
-
High 8.3
FrankenPHP before 1.13.4 contains a use-after-free vulnerability that leaves a dangling pointer to a freed environment …
-
High 7.4
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration vu…
-
High 8.4
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnera…
-
High 8.8
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type…
-
High 8.7
OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a string…
-
High 8.1CVE-2026-128046 Public exploit
OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options
OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload vulnerability because the general/file/protected_extensions blocklist omits phar, php8, and phps. Unauthenticated attackers can upload a .pha…
-
High 8.1
OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key
OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attac…
-
High 7.5
actix-http before 3.20.1 and actix-web before 4.18.2 Decompression Bomb DoS via encoding::Decoder
actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in encoding::Decoder that lets remote attackers exhaust memory and CPU via compressed bodies. Attackers can send small highly compressed gzip, deflate, Brotl…
-
High 8.3
Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to …
-
High 7.4
listmonk 6.0.0 before 7.0.0-beta.2 TOTP Brute-Force via /admin/login/twofa
Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to brute-force TOTP codes because the attempt counter resets on every new password login. Attackers can repeatedly submit credentials to POST /a…
-
High 8.7
exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplyi…
-
High 8.3
ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers…
-
High 7.5
ExcelJS through 4.4.0 Memory Exhaustion via Oversized Merged Cell Range
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to crash applications by supplying unbounded mergeCell ranges. Attackers can craft a small workbook with a mergeCell ref like A1:XFD1048576, c…
-
High 7.5
ExcelJS through 4.4.0 Memory Exhaustion via Oversized Defined Name Range
ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by supplying a workbook with an oversized defined-name range. DefinedNames.addEx expands ranges such as S!$A$1:$XFD$1048576 from xl/workbook.xml cell …
-
High 8.7
ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers t…
-
High 8.7
ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by suppl…