Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
379 results · Clear filters · Feed
-
Low 2.1
This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints.…
-
Low 2.3
Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that al…
-
Low 2.3
NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role use…
-
Low 1.1
An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Com…
-
Low 2.1
Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key …
-
Low 2.3
Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows cli…
-
Low 1.8
Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion vu…
-
Low 1.0
Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in th…
-
Low 2.7
The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is…
-
Low 2.3
OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and disc…
-
Low 2.3
Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension end…
-
Low 2.3
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users…
-
Low 2.3
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnera…
-
Low 2.3
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnera…
-
Low 2.3
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerab…
-
Low 2.3
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vuln…
-
Low 2.3
Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account…
-
Low 2.1
Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessi…
-
Low 2.3
ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js t…
-
Low 2.1
Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid…
-
Low 2.3
A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used t…
-
Low 2.9
bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three tak…
-
Low 2.0
The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loo…
-
Low 2.9
split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the …
-
Low 2.4
boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer imag…
-
Low 2.0
When MCUboot is built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT), bootutil_aes_ctr_drop() in boot/bootut…
-
Low 2.0
In MCUboot's serial-recovery encrypted-image support (boot/boot_serial/src/boot_serial_encryption.c), decrypt_image_inp…
-
Low 3.7
Linksys EA8100 Web UI cookie httponly flag
A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by hi…
-
Low 2.7
Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce t…
-
Low 2.3
Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js
Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote…
-
Low 2.3
Astro: Reflected XSS via unescaped slot names in @astrojs/svelte
Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote co…
-
Low 2.3
Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element…
-
Low 3.4
Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the …
-
Low 3.1
Addressable display_uri can show misleading hosts containing bidi and invisible characters
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control…
-
Low 3.1
Tornado: Open redirect via triple-slash redirect paths
Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable t…
-
Low 1.0
Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly …
-
Low 3.7
express-rate-limit skipFailedRequests / skipSuccessfulRequests: with the default MemoryStore, a request from an earlier window is still un-counted from the current window
express-rate-limit is a basic rate-limiting middleware for Express. From 8.6.0 until 8.7.2, the built-in MemoryStore returns a Client whose mutable resetTime object is retained by middleware using skipFailedRequests or skipSuccessfulRequests. When a later req…
-
Low 3.1
pgEdge Postgres MCP Server custom tools performed writes without user confirmation
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking onl…
-
Low 2.3
The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output …
-
Low 2.4
Docker Sandboxes restores removed automatically assigned port publications
Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox resta…