Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
771 results · Feed
-
High 8.7
paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint tha…
-
High 8.7
SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the …
-
Medium 5.3
paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by …
-
Medium 5.3
SurveyKing 1.12.0 through 1.13.2 Authentication Bypass via saveAnswer Response Submission
SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit respon…
-
High 7.1
SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the…
-
Medium 5.1
DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter commen…
-
Medium 5.3
SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a resp…
-
Medium 5.4
DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payloa…
-
Medium 5.1
ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by …
-
Medium 5.3
ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-…
-
High 7.1
free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the …
-
High 7.4
Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover
Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code …
-
High 8.2
Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview tha…
-
High 8.2
Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code…
-
Medium 5.1
Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users t…
-
Critical 9.1
Tactical RMM 0.17.0 through 1.6.1 Arbitrary File Read via Report Preview
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permi…
-
Critical 9.2
Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability t…
-
High 7.1
Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bra…
-
Medium 5.3
PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endp…
-
Medium 5.4
PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when…
-
Critical 9.3
NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to …
-
Medium 5.3
FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which re…
-
Medium 5.1
EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /a…
-
Medium 5.9
Nuxt dev server serves files from a parent directory that contains a lockfile
Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspa…
-
Medium 4.7
rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse one Rails::HTML::PermitScrubber across calls and mutate its tags and attributes without…
-
Medium 5.3
rails-html-sanitizer: Possible regular expression denial of service with certain configurations
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an…
-
Critical 9.3
A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free accou…
-
Medium 6.9
Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against…
-
High 7.5
iDentalSoft website information exposure
Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.
-
Medium 5.4
Omnispace Agora Project 26.10.0 Broken Access Control via isAutor()
Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Atta…
-
Medium 6.3
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticat…
-
High 8.5
Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general admini…
-
Medium 5.3
Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to i…
-
Medium 6.5
Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter
Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readR…
-
Medium 5.3
Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirec…
-
High 8.7
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticat…
-
High 8.1
Omnispace Agora Project 26.10.0 CSRF via Administrator Account Creation
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF toke…
-
Medium 6.0
In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules …
-
High 7.6
C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-m…
-
High 7.7
C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves…