Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
337 results · Clear filters · Feed
-
Medium 6.5
FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos
FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.…
-
Medium 6.9
FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to …
-
Medium 4.7
OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options wi…
-
Medium 4.7
OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated att…
-
Medium 5.1
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerabil…
-
Medium 4.3
OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-…
-
Medium 4.4
OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with c…
-
Medium 6.9
OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/o…
-
Medium 6.9
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted …
-
Medium 6.9
Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows re…
-
Medium 5.3
Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder
Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQ…
-
Medium 5.5
GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers
GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene wh…
-
Medium 4.1
The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files…
-
Medium 5.5
GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown
GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c because gf_sg_reset() frees unregistered prototypes still referenced by scene commands. Attackers can supply a crafted XMT/BT scene declaring prot…
-
Medium 5.0
Dokploy 0.28.0 before 0.31.1 Path Traversal via patch.readRepoDirectories repoPath
Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one …
-
Medium 5.3
Miniflux before 2.3.5 Password Change Without Current Password via Settings Form
Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session to change the account password without supplying the current password. Attackers with a stolen session cookie or unattended device can submit…
-
Medium 6.3
listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attacker…
-
Medium 4.8
ExcelJS through 4.4.0 Prototype Pollution via __proto__ Defined Name
ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to Object.prototype through a crafted defined name referencing a __proto__ sheet. Attackers can supply an xlsx whose xl/workbook.xml definedName range…
-
Medium 6.9
ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in lib/utils/shared…
-
Medium 4.2
ExcelJS through 4.4.0 Formula Injection via Table Totals Row Column Names
ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrus…
-
Medium 6.5
Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability. A low p…
-
Medium 4.3
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileg…
-
Medium 5.4
Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains unauthorized access vulnerability. A low privileged a…
-
Medium 6.4
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vu…
-
Medium 4.3
Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Cleartext Storage of Sensitive Information vulnerab…
-
Medium 4.3
Dell PowerScale InsightIQ, Version 6.4.0, contain an Insufficient Verification of Data Authenticity vulnerability. A lo…
-
Medium 5.4
Quay: quay: reflected xss via image_id in v1 registry error responses
A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially cr…
-
Medium 5.4
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains Unauthorized access vulnerability. A low privileged a…
-
Medium 6.3
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File v…
-
Medium 5.4
Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileg…
-
Medium 6.4
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, containsan Insertion of Sensitive Information into Log File vu…
-
Medium 5.4
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Improper Verification of Cryptographic Signature v…
-
Medium 4.3
Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File v…
-
Medium 5.4
Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0 , contains a Missing Authorization vulnerability. A low privile…
-
Medium 6.4
Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File v…
-
Medium 5.4
Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileg…
-
Medium 4.3
Dell PowerScale InsightIQ, Versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File v…
-
Medium 4.3
Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File v…
-
Medium 6.9
Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior o…
-
Medium 6.9
Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway.