Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
771 results · Feed
-
Medium 6.5
WordPress MapSVG plugin <= 9.0.4 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 9.0.4.
-
Medium 6.5
WordPress Royal Elementor Addons plugin <= 1.7.1070 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1070.
-
Medium 6.5
WordPress Gutenberg Blocks plugin <= 3.7.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Stored XSS.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
-
Medium 6.5
DoS vulnerability in JBL Flip 4
Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific malformed Bluetooth messages from an unauthenticated attacker.
-
Medium 5.3
WordPress Product Feed PRO for WooCommerce plugin <= 13.5.8 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Rymera Web Co Product Feed PRO for WooCommerce woo-product-feed-pro allows Code Injection.This issue affects Product Feed PRO for WooCommerce: from n/a through 13.5…
-
Medium 6.5
WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.24.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation allows Stored XSS.This issue affects YITH WooCommerce Ajax Product Filter: from n/…
-
High 7.0
TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus Package Installer
Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü Pardus Package Installer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pardus Package In…
-
Medium 5.3
WordPress Spectra plugin <= 2.20.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through 2.20.5.
-
Medium 5.3
WordPress Gutenberg Blocks plugin <= 3.7.6 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
-
Medium 4.6
Dell PowerStore contains an improper input validation vulnerability. An authenticated low-privileged attacker could exp…
-
Medium 5.3
WordPress We’re Open! plugin <= 2.8 - Content Injection vulnerability
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noah Hearle We’re Open! opening-hours allows Code Injection.This issue affects We’re Open!: from n/a through 2.8.
-
High 8.3
Dell PowerStore contains an External Control of File Name or Path vulnerability. A remote authenticated attacker could …
-
High 8.8
Dell PowerStore contains an authorization-bypass vulnerability that could lead to elevation of privilege to administrat…
-
High 7.5
KVStoreInterpreter::verify_signature_legacy answers true for every token and every key
`KVStoreInterpreter::verify_signature_legacy(&PushDrop, &PublicKey)`, public and deprecated since 0.2.0 (the crate's first release), read neither argument and answered `true`. A KVStore token signed by nobody, a signed token checked against a key other than i…
-
High 8.2
frr: bgpd double free of peer-group Site-of-Origin when dynamic neighbors disconnect
In FRRouting, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group used by a "bgp listen range" also has a Site-of-Origin configured ("neighbor PG soo"). Each dynamic neighbor shares the peer-group's SoO value instead of g…
-
Unscored —
Arbitrary file write via path traversal in unpackToDir
# Arbitrary file write via path traversal in unpackToDir `Codec.Archive.unpackToDir` extracts a tar (or other archive supported by the libarchive C library) from a `ByteString` into a directory. `unpackToDirLazy` is the streaming variant; both funnel through …
-
High 7.8
X.Org Server XvQueryImageAttributes Negative Size Reply
A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before 21.1.26 and xwayland before 24.1.15 could be used to causes crashes by authenticated X clients.
-
Unscored —
Apache DataSketches C++: Out-of-bounds write in KLL sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a KLL sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized level boundaries were not validated. This issue aff…
-
Unscored —
Apache DataSketches C++: Out-of-bounds write in REQ sketch deserialization allows memory corruption via a crafted sketch
Out-of-bounds Write vulnerability in Apache DataSketches C++. An application that deserializes a REQ sketch from an untrusted source can have heap memory corrupted by a crafted sketch, because the serialized compactor headers were not validated. This issue af…
-
Medium 6.9
X.Org Server XRes QueryClientIds Request Size Overflow
A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information.
-
Low 2.1
Information Disclosure Vulnerability in eMudhra emBridge
This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authori…
-
High 8.7
Multiple Vulnerabilities in OpenKM Community Edition
Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower la…
-
High 8.3
Multiple Vulnerabilities in OpenKM Community Edition
Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote atta…
-
High 8.3
Magento LTS vulnerable to Stored XSS via TinyMCE WYSIWYG Editor
OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to ex…
-
High 8.6
Zipline through 3.7.9 Invite Bypass via /api/auth/register Endpoint
Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration …
-
High 8.3
Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via t…
-
High 8.1
Zipline through 4.3.2 Path Traversal via x-zipline-filename Header
Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or…
-
Medium 6.9
Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload f…
-
Low 2.3
Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that al…
-
Medium 6.1
Zipline before 3.7.12 XSS via url parameter on login page
Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that exec…
-
Medium 6.7
Scapy before 2.7.0 Insecure Deserialization RCE via Session Files
Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s opt…
-
High 8.6
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execut…
-
High 8.2
Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS…
-
High 7.5
Cudy TR3000 before 2.5.42 Unauthenticated RCE via mDNS Automesh Broker Adoption
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycm…
-
Medium 6.8
Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE
Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent u…
-
Critical 9.2
Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so th…
-
Medium 5.9
Cudy TR3000 before 2.5.42 Stack Buffer Overflow via obuspa KeyPassphrase Getter
Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicio…
-
High 8.7
Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP…
-
High 7.4
Cudy TR3000 before 2.5.42 Curl Argument Injection via TR-069 Upload
Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add opt…
-
High 8.6
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execut…