Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
3,155 results · Clear filters · Feed
-
Medium 5.1
Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS). Due to improper input validation, an authenticated attack…
-
Medium 5.1
The MISP Modules website component contains an open redirect vulnerability in its login endpoint. The /login route acce…
-
Medium 5.3
Kroxylicious-authorizer-acl: kroxylicious: acl rule file regex escapes are stripped, broadening 'matching' authorization rules
A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes `matching /…/` regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as `matching /orders\.v1/` is c…
-
Medium 5.3
Mine CloudVod < 2.6.7 - Unauthenticated Paid Lesson Content Disclosure
The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated…
-
Medium 4.3
Essential Real Estate 5.3.5 - Customer+ Email Relay Allowlist Poisoning
The Essential Real Estate WordPress plugin before 5.3.6 does not verify that the recipients it allows for its contact email action are legitimate, allowing users with the self-registered Customer role to add any address to that allowlist so that unauthenticat…
-
Medium 4.3
WP Remote Users Sync < 2.2.1 - Subscriber+ Activity Log Deletion
The WP Remote Users Sync WordPress plugin before 2.2.1 does not have authorisation and CSRF checks in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete the WP Remote Users Sync WordPress plugin before 2.2.1's entire act…
-
Medium 5.3
AppPresser < 5.0.0 - Unauthenticated Plugin and Theme Version Disclosure
The AppPresser WordPress plugin before 5.0.0 does not restrict access to two of its REST API endpoints, allowing unauthenticated visitors to retrieve the installed versions of AppPresser, its add-ons, several third-party AppPresser WordPress plugin before 5.0…
-
Medium 4.5
Contact Form 7 < 6.2.5 - Editor+ Sensitive User Data Disclosure via Form Default Values
The Contact Form 7 WordPress plugin before 6.2.5 does not restrict which user properties a form field's default value can be populated from, allowing users with the Editor role and above to obtain the password hash and sensitive user meta (such as two-factor …
-
Medium 6.9
A vulnerability was identified in Zackriya-Solutions Meetily up to 0.4.1. Affected is an unknown function of the file b…
-
Medium 4.3
Cairo-dock Glx-Dock href Attribute bg_forum.php cross site scripting
A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg_forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remo…
-
Medium 5.3
A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vul…
-
Medium 5.1
Unchecked serial-recovery image index causes out-of-bounds slot-table read in MCUboot Zephyr port
MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the host-supplied image field of an MCUmgr image-upload request into img_num (a full 32-bit value) and latches it on the off == 0 packet without any rang…
-
Medium 4.0
MCUboot's serial-recovery image-upload handler bs_upload() in boot/boot_serial/src/boot_serial.c declares const struct …
-
Medium 4.7
Heap overflow via oversized RSA signature in GCP KMS signing callback
A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write on the heap. A fixed-size output buffer is used under an assumption about cryptographic key size that is never validated, so when the libra…
-
Medium 6.3
A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/cor…
-
Medium 5.3
A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsA…
-
Medium 6.9
@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override co…
-
Medium 4.8
@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation
@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without group…
-
Medium 5.4
Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 un…
-
Medium 6.3
Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems
Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /_image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose pa…
-
Medium 6.5
Vault vulnerable to ACL deny bypass via trailing slash
Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration pa…
-
Medium 5.9
Vault integrated storage join may disclose server environment credentials
HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environme…
-
Medium 5.3
OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api
OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trac…
-
Medium 5.3
Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in…
-
Medium 5.3
Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that all…
-
Medium 5.3
Hono: `mount()` and `app.mount()` can forward a path that bypasses middleware scoped inside the mount prefix
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount() can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to …
-
Medium 5.3
Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('form') uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal param…
-
Medium 5.3
Hono: `csrf()` does not check requests sent by hyperlink auditing (`text/ping`)
Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf() limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium h…
-
Medium 4.8
Addressable URI normalization resolves some dotted path segments to the wrong path
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a differ…
-
Medium 5.9
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.…
-
Medium 5.9
Addressable: Regular Expression Denial of Service in Addressable templates with multiple variables
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI templates with several variables in one expression or several adjacent expressions generate ambiguous regular expressio…
-
Medium 5.9
Addressable: Denial of service in URI path normalization
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing …
-
Medium 5.9
Addressable: Regular Expression Denial of Service in Addressable templates with certain exploded expressions
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions using the explode modifier with the slash, dot, semicolon, question-mark, or ampersand operators g…
-
Medium 4.3
Addressable display_uri can show misleading hosts with invalid Punycode A-labels
Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them uncha…
-
Medium 6.5
MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Route
MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json/multivendorx/v1/stores REST route that allows authenticated vendors to access administrative flag handlers due to the store_owner role possessing th…
-
Medium 5.9
basic-ftp: Uncaught exception crashes the Node.js process when a password (or resumed-download path) contains CR/LF
basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carriage return, line feed, or NUL characters, but calls made from response handlers execute synchronously inside the control socket's data event without …
-
Medium 5.3
basic-ftp: Uncaught TypeError in MLSD directory-listing parser via __proto__ fact name causes DoS in Client.list()
basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD.ts uses untrusted fact names from the FTP server as keys in the plain-object factHandlersByName dictionary without checking that the resolved proper…
-
Medium 5.4
@hono/node-server: WebSocket upgrade request-target starting with `//` replaces the host in `c.req.url`, bypassing `Origin` checks
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade path resolves a raw request-target beginning with // against a base URL built from the Host header, causing the WHATWG URL parser to treat the requ…
-
Medium 5.3
@hono/node-server: Unhandled `ECONNRESET` on the socket during an asynchronous WebSocket upgrade crashes the process
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrade handler waits for the Hono application to finish asynchronous middleware or handler work without first attaching an error listener to the socket. I…
-
Medium 5.3
@hono/node-server: Backslash in the request path is parsed as a path separator, bypassing path-based access control at a reverse proxy
@hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6, the server passes a raw request-target containing a backslash in its path to the WHATWG URL parser, which treats the backslash as a path separator a…