Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
426 results · Clear filters · Feed
-
Low 2.1
Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid…
-
Low 3.5
Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name
The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets …
-
Low 2.3
A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used t…
-
Low 2.9
MCUboot image hash span is not bounded against the slot, allowing a read past the flash area during image validation
bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes a…
-
Low 2.0
The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loo…
-
Low 2.9
split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the …
-
Low 2.4
Uninitialised bootloader stack disclosed into the measured-boot attestation record via a short EXPECTED_HASH TLV in MCUboot
boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(image_hash)) and then r…
-
Low 2.0
When MCUboot is built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT), bootutil_aes_ctr_drop() in boot/bootut…
-
Low 2.0
In MCUboot's serial-recovery encrypted-image support (boot/boot_serial/src/boot_serial_encryption.c), decrypt_image_inp…
-
Low 3.7
Linksys EA8100 Web UI cookie httponly flag
A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by hi…
-
Low 2.7
Vault audit device prefix vulnerable to log injection
Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentia…
-
Low 2.3
Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js
Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote…
-
Low 2.3
Astro: Reflected XSS via unescaped slot names in @astrojs/svelte
Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote co…
-
Low 2.3
Astro: XSS via attribute injection in dynamic tag names
Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attribut…
-
Low 3.4
Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection
Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the …
-
Low 3.1
Addressable display_uri can show misleading hosts containing bidi and invisible characters
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control…
-
Low 3.1
Tornado: Open redirect via triple-slash redirect paths
Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable t…
-
Low 1.0
Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly …
-
Low 3.7
express-rate-limit skipFailedRequests / skipSuccessfulRequests: with the default MemoryStore, a request from an earlier window is still un-counted from the current window
express-rate-limit is a basic rate-limiting middleware for Express. From 8.6.0 until 8.7.2, the built-in MemoryStore returns a Client whose mutable resetTime object is retained by middleware using skipFailedRequests or skipSuccessfulRequests. When a later req…
-
Low 3.1
pgEdge Postgres MCP Server custom tools performed writes without user confirmation
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking onl…
-
Low 2.3
The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output …
-
Low 2.4
Docker Sandboxes restores removed automatically assigned port publications
Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox resta…
-
Low 3.3
The user-mode system call verifier z_vrfy_charger_get_prop() in drivers/charger/charger_handlers.c declares an uninitia…
-
Low 3.7
PostgreSQL pg_basebackup can use backup manifest content as a format string
Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read byt…
-
Low 3.1
PostgreSQL foreign key and JSON conversions bypass EXECUTE privilege on cast functions
Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database…
-
Low 3.8CVE-2026-120490 Public exploit
On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules ca…
-
Low 3.3
Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures
-
Low 2.7
Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets modu…
-
Low 3.9
Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory
A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). Whe…
-
Low 1.9
A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML …
-
Low 3.3CVE-2026-113408 Public exploit
Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository
-
Low 3.1
Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to by…
-
Low 3.8
Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST Endpoints
The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and…
-
Low 3.8
Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability
Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged c…
-
Low 3.7
Zipline before 4.8.0 maxViews Limit Bypass via Race Condition
Zipline before 4.8.0 contains a race condition vulnerability in src/server/routes/raw/[id].ts that allows remote attackers to bypass file maxViews limits through non-atomic view counting. Attackers holding a file link can send parallel requests that read the …
-
Low 3.1
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the re…
-
Low 3.4
Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised…
-
Low 3.1
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised th…
-
Low 3.1
Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the rend…
-
Low 3.1
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the re…