Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
771 results · Feed
-
Medium 5.3
NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop
## Summary `LegalitySyllableTokenizer.tokenize` in the NLTK tokenizer package contains an unguarded O(n^2) processing loop. When the method is called on a single token that consists of a long run of vowels (for example `"a" * n`), it consumes CPU time proport…
-
Medium 6.2
Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations
A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…
-
Medium 5.5
Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize
A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…
-
Medium 6.4
Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route
Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplyin…
-
Critical 9.8
VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx
VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no au…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader c…
-
Medium 6.5
Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure
Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_setting…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses e…
-
High 8.3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined req…
-
High 8.2
AIOHTTP: Unbounded buffering of data received during an upgrade request
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit …
-
High 7.5
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_ch…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post() does no…
-
High 7.1
Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the tic…
-
Medium 6.3
AIOHTTP: Unbounded cookie storage in client CookieJar
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicio…
-
Medium 6.8
Expired Vault login MFA requests may remain redeemable
Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should h…
-
High 8.2
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain…
-
High 8.5
- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, an…
-
Medium 6.5
Vault vulnerable to ACL deny bypass via case-variant auth method user and group names
Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissio…
-
High 8.6
Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows aut…
-
Medium 5.9
SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 5.5.7 until versions 5.5.8 and 6.0.1, , @sveltejs/adapter-node can attempt to add a header to an immutable request in a context that causes the serv…
-
Medium 5.9
SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitesp…
-
Medium 5.9
SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be…
-
High 7.5
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 u…
-
Medium 5.9
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 u…
-
High 7.5
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 un…
-
Medium 5.9
SvelteKit: Unhandled URIError when `reroute` rewrites a malformed pathname crashes adapter-node
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the…
-
Medium 6.3
Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with cha…
-
Medium 5.3
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.7…
-
High 7.5
dnspython has excessive memory and CPU use
dnspython is a DNS toolkit for Python. Prior to version 2.9.2, the from_text() parser for WKS records does not require the service number to be between 0 and 65535 before using it as a bitmap offset. An attacker-controlled zone file can supply a larger number…
-
High 8.2
Hugo Blog is a tech blog site. In commit 744ca15 and prior, the AI assistant proxy exposes three HTTP endpoints (POST /…
-
Medium 6.5
LearnPress Course Wishlist < 4.1.2 IDOR via render_button
LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead o…
-
High 8.3
Budget Board's OIDC login links to an existing local account by email alone, with no email_verified check, enabling account takeover of pre-existing users
Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provi…
-
Low 2.2
russh try_sign: asynchronous confirmation can sign after agent lock
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, try_sign() captures an Arc<PrivateKey> before awaiting Agent::confirm() and does not revalidate the shared lock state or key presence af…
-
Medium 6.0
In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the l…
-
Medium 5.2
PolicyPress is a compliance policy management tool for small and mid-size teams. Prior to version 1.4.1, sensitive cont…
-
Low 3.7
russh kex_done: shared-secret callback runs before server host-key verification
russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kex_done() with the raw shared secret before check_server_key() accep…
-
High 7.1
Hubleys is a dashboard for self-hosted services. Prior to version 0.5.2, any authenticated (non-admin) Hubleys user can…
-
Medium 6.9
bit-vec: unsoundness arising with `deserialize` then `get_unchecked`
bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted source and unsafe get_unchecked. A user of this library may be impacted by incorrect behavior if they perform deserializ…
-
Medium 5.3
OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members,…