Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
337 results · Clear filters · Feed
-
Medium 6.7
Scapy before 2.7.0 Insecure Deserialization RCE via Session Files
Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s opt…
-
Medium 6.8
Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE
Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent u…
-
Medium 5.9
Cudy TR3000 before 2.5.42 Stack Buffer Overflow via obuspa KeyPassphrase Getter
Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicio…
-
Medium 6.5
NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging
NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup con…
-
Medium 6.9
NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge th…
-
Medium 6.5
NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint
NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, u…
-
Medium 6.3
NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip
NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's fi…
-
Medium 5.9
NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition
NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitima…
-
Medium 5.1
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values a…
-
Medium 6.9
NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retri…
-
Medium 6.5
NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read
NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private i…
-
Medium 5.3
NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service…
-
Medium 6.8
NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths
NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weigh…
-
Medium 6.3
NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypass…
-
Medium 6.9
NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop
NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causi…
-
Medium 6.9
NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop
NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-…
-
Medium 5.8
OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates
OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typicall…
-
Medium 5.3
Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record ty…
-
Medium 4.3
REDAXO before 5.21.6 Authorization Bypass of Live Version Permission
REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle,…
-
Medium 6.5
Dockhand before 1.0.55 Arbitrary File Read via Stack Adoption Compose Path
Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the…
-
Medium 5.1
Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor u…
-
Medium 4.3
Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions
Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in ad…
-
Medium 5.4
Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys
Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can subm…
-
Medium 5.3
Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action t…
-
Medium 5.3
Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as ba…
-
Medium 5.4
Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets
Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing admin_id owner scoping. Attackers can supply filter[admin_id] to list drafts, invoke duplicate() o…
-
Medium 4.9
n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Sto…
-
Medium 6.3
n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accept…
-
Medium 4.8
n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the …
-
Medium 5.3
n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool
n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright re…
-
Medium 5.1
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect vulnerabil…
-
Medium 6.3
n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API…
-
Medium 6.3
n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated att…
-
Medium 6.9
vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which use…
-
Medium 5.3
SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fe…
-
Medium 5.3
vLLM 0.14.0rc1 before 0.31.0 Heap Address Disclosure via sanitize_message()
vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, …
-
Medium 5.3
vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels
vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when ma…
-
Medium 6.5
vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames
vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large v…
-
Medium 6.5
Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint
Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with…
-
Medium 6.8
Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creati…