Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
3,116 results · Clear filters · Feed
-
High 8.7
Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix N…
-
High 8.7
Memory overflow in client-certificate authentication can lead to unpredictable or erroneous behavior or Denial of Servi…
-
High 8.7
Memory overflow in KBA (knowledge-based authentication) can lead to unpredictable or erroneous behavior or Denial of Se…
-
High 8.7
Memory overflow in WebAuth authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citri…
-
High 8.7
Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix N…
-
High 8.7
Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler
-
High 7.3
SourceCodester Food Ordering System Admin Image update_food.php unrestricted upload
A vulnerability was identified in SourceCodester Food Ordering System 1.0. Affected by this issue is some unknown functionality of the file admin/update_food.php of the component Admin Image Handler. Such manipulation of the argument cmd leads to unrestricted…
-
High 7.3
AIP-PUB ACPs-community Discovery Server main.py missing authentication
A vulnerability was detected in AIP-PUB ACPs-community up to 2.2.0. This impacts an unknown function of the file discovery-server/app/main.py of the component Discovery Server. The manipulation results in missing authentication. The attack may be launched rem…
-
High 7.3
AIP-PUB ACPs-community verify-code Endpoint service_auth.py send_verification_code improper authentication
A weakness has been identified in AIP-PUB ACPs-community up to 2.2.0. The impacted element is the function send_verification_code of the file registry-server/app/account/service_auth.py of the component verify-code Endpoint. Executing a manipulation of the ar…
-
High 7.7
A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to …
-
High 8.4
Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size
Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimension…
-
High 8.7
Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data
Pillow is a Python imaging library. From 1.0 through 12.3.0, ImageFileDirectory_v2.load() in src/PIL/TiffImagePlugin.py retains a separate bytes object for each out-of-line IFD tag value without limiting the total data read or preventing distinct tags from re…
-
High 7.5
msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.7, the Java-platform msgpack gem for JRuby allocated arrays and byte buffers directly from attacker-controlled array32, str32, and bin32 declared sizes befo…
-
High 7.0
Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared temp dir
A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC driver's native library loading routine will accept and load without verifying its origin. Loading the driver class in a Java application may …
-
High 8.6
An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-…
-
High 8.8
datamodel-code-generator < 0.84.0 Code Injection via x-python-type Annotation
datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve arbitrary code execution by supplying a malicious JSON Schema with a crafted x-python-type annotation containing a string ast.Constant node in a su…
-
High 8.7
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authenticat…
-
High 8.8
Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller
A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with…
-
High 8.8
XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attacker…
-
High 8.6
BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that update…
-
High 7.1
Candlepin: consumer certificate can register systems in another organization
A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that aut…
-
High 7.7
Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)
A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete f…
-
High 7.1
Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed
An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts.…
-
High 8.7
XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconf…
-
High 8.2
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and…
-
High 8.2
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and…
-
High 8.2
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and…
-
High 8.1
BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. In versions 1.5.0 and 1.6.0-rc1, there is a restore logic flaw in bacnet-stack that is reachable through the official, unmodified apps/server management path when BACNET_BACKU…
-
High 7.5
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, …
-
High 7.5
BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, an out-of-bounds read vulnerability exists in bacnet-stack's AtomicWriteFile record-access path. The bug is caused by a mismatch between an …
-
High 7.5
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.0 to before 1.4.4…
-
High 8.2
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, …
-
High 7.1
BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoin…
-
High 7.2
Dixell/Copeland XWEB EVO OS Command Injection via backup.lua
XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua…
-
High 7.2
Dixell/Copeland XWEB EVO OS Command Injection via devices.lua
XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related sh…
-
High 8.1
Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field
XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped in…
-
High 8.1
Dixell/Copeland XWEB EVO Predictable Root Password Generation
XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credenti…
-
High 8.1
Dixell/Copeland XWEB EVO Predictable Administrator Password Generation
XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze …
-
High 7.8
Dixell/Copeland XWEB Setuid Lua CGI Root Command Injection
XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbit…
-
High 7.0
Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escala…