Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
771 results · Feed
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to …
-
High 7.2
Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call…
-
High 8.3
SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve…
-
High 7.2
Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload
Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.ex…
-
Critical 9.1
SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, a…
-
Medium 6.5
NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging
NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup con…
-
High 7.5
SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords
SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod…
-
Medium 6.9
NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge th…
-
Medium 6.5
NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint
NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, u…
-
Critical 9.3CVE-2026-126269 Public exploit
NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to …
-
High 7.7
NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read
NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers r…
-
Critical 9.2CVE-2026-126273 Public exploit
NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-…
-
High 7.1
NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to …
-
High 8.7CVE-2026-126274 Public exploit
NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog
NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped i…
-
High 8.2
NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a…
-
High 7.1
NocoDB before 2026.09.0 IDOR in Row Comment Operations
NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read priva…
-
High 8.7
NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attacke…
-
High 7.5
NocoDB before 2026.08.1 Password Reset Token Race Condition
NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt h…
-
Medium 6.3
NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip
NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders unescaped field references from AI field prompts as HTML in a tooltip. Attackers with the Creator role or above can store markup in a prompt's fi…
-
Critical 9.1
NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens becau…
-
High 7.1
NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation …
-
High 8.8
NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens
NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as account-wide credentials because the token's base_id is never stored or checked. Attackers holding a leaked token can read, write and delete reco…
-
High 8.0
NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update
NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts where updating a user's legacy organization role rewrites their default-workspace role. Revoked users can silently regain Creator-level read…
-
Low 2.3
NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role use…
-
High 8.1
NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue
NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows unauthenticated attackers to execute script by embedding an ASCII control character in the ncRedirectUrl scheme. Attackers can send a crafted…
-
High 8.3
NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run…
-
Medium 5.9
NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition
NocoDB before 2026.06.2 contains a race condition vulnerability in oauth-token.service.ts that allows attackers to reuse a refresh token by presenting it concurrently during non-atomic rotation. Attackers holding a captured refresh token can race the legitima…
-
Medium 5.1
NocoDB before 2026.06.1 contains a CSV formula injection vulnerability in export.service.ts that writes record values a…
-
Medium 6.9
NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retri…
-
Medium 6.5
NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read
NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private i…
-
Medium 5.3
NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service…
-
High 8.8
NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query
NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base members' email addresses into the SQL text of queries resolving user, created-by or last-modified-by fields. Registered users can set an email w…
-
High 7.1
NocoDB before 2026.06.2 contains an attachment size limit bypass that allows authenticated Editor users to store oversi…
-
Medium 6.8
NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths
NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weigh…
-
High 7.5
Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login
Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remembe…
-
Medium 6.3
NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypass…
-
High 7.5
NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form
NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by …
-
High 8.7
NLTK: Quadratic-time CPU denial of service in ConllCorpusReader SRL instance builder via nested span rescan
NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates …
-
High 7.5
NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring
NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, trigge…
-
Medium 6.9
NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop
NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causi…