Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
3,138 results · Clear filters · Feed
-
Medium 5.5
Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize
A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…
-
Medium 6.4
Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route
Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplyin…
-
Medium 6.5
Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure
Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_setting…
-
Medium 6.3
AIOHTTP: Unbounded cookie storage in client CookieJar
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicio…
-
Medium 6.8
Expired Vault login MFA requests may remain redeemable
Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should h…
-
Medium 6.5
Vault vulnerable to ACL deny bypass via case-variant auth method user and group names
Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissio…
-
Medium 5.9
SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 5.5.7 until versions 5.5.8 and 6.0.1, , @sveltejs/adapter-node can attempt to add a header to an immutable request in a context that causes the serv…
-
Medium 5.9
SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitesp…
-
Medium 5.9
SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be…
-
Medium 5.9
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 u…
-
Medium 5.9
SvelteKit: Unhandled URIError when `reroute` rewrites a malformed pathname crashes adapter-node
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, the reroute hook could rewrite an invalid percent-encoded pathname into a valid route and reach a comparison that decoded the…
-
Medium 6.3
Flowise through 3.1.4 contains a server-side request forgery vulnerability that allows authenticated attackers with cha…
-
Medium 5.3
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.7…
-
Medium 6.5
LearnPress Course Wishlist < 4.1.2 IDOR via render_button
LearnPress Course Wishlist Add-on before 4.1.2 contains an insecure direct object reference vulnerability that allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to the render_button callback instead o…
-
Medium 6.0
In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the l…
-
Medium 5.2
PolicyPress is a compliance policy management tool for small and mid-size teams. Prior to version 1.4.1, sensitive cont…
-
Medium 6.9
bit-vec: unsoundness arising with `deserialize` then `get_unchecked`
bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted source and unsafe get_unchecked. A user of this library may be impacted by incorrect behavior if they perform deserializ…
-
Medium 5.3
OpenTelemetry-Go: Eager W3C baggage-property materialization causes bounded memory-allocation amplification
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From version 1.0.0-RC1 until version 1.47.0, baggage.Parse and propagation.Baggage.Extract eagerly materialize every W3C baggage property through parseMember, grow property slices, serialize members,…
-
Medium 5.3
opentelemetry-go: AttributeValueLengthLimit is fully bypassed by attribute values composed of valid U+FFFD runes
OpenTelemetry-Go is the Go implementation of OpenTelemetry. From SDK version 1.33.0, SDK log version 0.9.0, and trace version 1.35.0 until version 1.47.0, the AttributeValueLengthLimit and WithAttributeValueLengthLimit truncation paths in sdk/internal/attrnor…
-
Medium 5.3
BACnet Stack: Pre-auth OOB read in xy_color_decode (BACnetXYColor) via WriteGroup/WriteProperty
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5 and 1.5.1, a single unauthenticated BACnet/IP UDP datagram (port 47808) triggers an out-of-bounds read in xy_color_decode() (src/bacnet/lighting.c), re…
-
Medium 4.8
sqlite3-ruby: SQL Query Truncation
sqlite3 provides Ruby bindings for the SQLite3 embedded database. Prior to 2.10.2, sqlite3-ruby casts Ruby string lengths to int before passing SQL through Database#prepare, bound String or Blob values through Statement#bind_param, and String or Blob results …
-
Medium 6.9
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the BACnet …
-
Medium 6.9
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to version 1.5.1, the RAMFS-b…
-
Medium 5.8
OpenTelemetry JavaScript: Insertion of Sensitive Information into Log File and Exposure of Sensitive Information to an Unauthorized Actor in @opentelemetry/instrumentation-http
OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryP…
-
Medium 6.9
Out-of-bounds write on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus
An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi which could lead to a denial of service of the affected communication device.
-
Medium 6.8
envd: Host file disclosure through requirements path traversal and TOCTOU
envd provides reproducible development environments for humans and agents. In versions starting with 0.3.38 and before 1.3.6, insufficient containment of host-side requirements-file reads in install.python_packages(requirements=...) could allow access to fi…
-
Medium 6.4
Apache APISIX: authz-keycloak authorization scope mismatch
Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue…
-
Medium 6.4
Apache APISIX: Multi-auth preserves client-supplied Wolf identity headers
Authentication bypass by spoofing vulnerability in Apache APISIX. On a route where multi-auth falls back from wolf-rbac to another successful authenticator, client-supplied Wolf identity headers can remain in the request. A downstream service that relies on t…
-
Medium 6.3
Apache APISIX: unauthorized access to mTLS protected resources
Interpretation Conflict, leading to Incorrect Authorization vulnerability in Apache APISIX. With match_uri_encoded_slash enabled and skip_mtls_uri_regex configured, a client without a certificate can reach an upstream behind a route that requires one, limited…
-
Medium 6.9
Apache APISIX: openapi-to-mcp tool call can reach an API path the document does not declare
Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affec…
-
Medium 5.3
GLPI is a free asset and IT management software package. From 9.5.0 until 10.0.27 and 11.0.9, authenticated users could…
-
Medium 6.5
Nuxt: Incomplete fix for GHSA-9v7c-q64q-vv33: a leading `//` in the request path bypasses `server/middleware` path checks and server route rules on page routes
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, Nuxt parses a request path beginning with // as a URL host before rendering a page, while Nitro server/middleware and routeRules continue to evaluate the original path. An un…
-
Medium 5.3
Nuxt exposes the message and data of unhandled errors thrown during server rendering
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the application. In productio…
-
Medium 6.9
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, _payload.json URL generation and t…
-
Medium 6.5
Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server from 3.20.…
-
Medium 5.1
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageService…
-
Medium 5.4
paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticate…
-
Medium 5.1
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user…
-
Medium 5.3
paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by …
-
Medium 5.3
SurveyKing 1.12.0 through 1.13.2 Authentication Bypass via saveAnswer Response Submission
SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit respon…