Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
287 results · Clear filters · Feed
-
Medium 6.9
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet …
-
Medium 6.9
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-b…
-
Medium 5.8
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumenta…
-
Medium 6.9
Out-of-bounds write on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi which could lead to a denial of service of the affected communication device.
-
Medium 6.8
envd: Host file disclosure through requirements path traversal and TOCTOU
envd provides reproducible development environments for humans and agents. In versions starting with 0.3.38 and before 1.3.6, insufficient containment of host-side requirements-file reads in install.python_packages(requirements=...) could allow access to fi…
-
Medium 6.4
Apache APISIX: authz-keycloak authorization scope mismatch
Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue…
-
Medium 6.4
Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers
Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on t…
-
Medium 6.3
Apache APISIX: unauthorized access to mTLS protected resources
Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With match_uri_encoded_slash enabled and skip_mtls_uri_regex configured, a client without a certificate can reach an upstream behind a route that requires one, limited…
-
Medium 6.9
Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare
Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affec…
-
Medium 5.3
GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could…
-
Medium 6.5
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request path beginni…
-
Medium 5.3
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown …
-
Medium 6.9
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, _payload.json URL generation and t…
-
Medium 6.5
Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server from 3.20.…
-
Medium 5.1
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageService…
-
Medium 5.1
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notific…
-
Medium 5.1
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user…
-
Medium 5.3
paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by …
-
Medium 6.9
SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers …
-
Medium 5.1
DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter commen…
-
Medium 5.3
SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a resp…
-
Medium 5.1
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authe…
-
Medium 5.1
ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by …
-
Medium 5.3
ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-…
-
Medium 5.1
Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users t…
-
Medium 5.3
PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endp…
-
Medium 5.1
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to injec…
-
Medium 5.3
FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which re…
-
Medium 5.1
EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /a…
-
Medium 5.9
Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory…
-
Medium 4.7
rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse one Rails::HTML::PermitScrubber across calls and mutate its tags and attributes without…
-
Medium 5.3
rails-html-sanitizer: Possible regular expression denial of service with certain configurations
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an…
-
Medium 6.9
Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against…
-
Medium 5.3
Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function …
-
Medium 6.3
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticat…
-
Medium 5.3
Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to i…
-
Medium 5.3
Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirec…
-
Medium 6.0
In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules …
-
Medium 6.9
C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows maliciou…
-
Medium 5.9
C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers …