Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
3,138 results · Clear filters · Feed
-
Medium 5.1
DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter commen…
-
Medium 5.3
SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a resp…
-
Medium 5.4
DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payloa…
-
Medium 5.1
ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by …
-
Medium 5.3
ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-…
-
Medium 5.1
Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users t…
-
Medium 5.3
PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endp…
-
Medium 5.4
PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when…
-
Medium 5.3
FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which re…
-
Medium 5.1
EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /a…
-
Medium 5.9
Nuxt dev server serves files from a parent directory that contains a lockfile
Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspa…
-
Medium 4.7
rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse one Rails::HTML::PermitScrubber across calls and mutate its tags and attributes without…
-
Medium 5.3
rails-html-sanitizer: Possible regular expression denial of service with certain configurations
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an…
-
Medium 6.9
Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against…
-
Medium 5.4
Omnispace Agora Project 26.10.0 Broken Access Control via isAutor()
Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Atta…
-
Medium 6.3
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticat…
-
Medium 5.3
Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to i…
-
Medium 6.5
Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter
Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readR…
-
Medium 5.3
Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirec…
-
Medium 6.0
In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules …
-
Medium 6.5
C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND
C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to AP…
-
Medium 6.9
C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows maliciou…
-
Medium 5.9
C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers …
-
Medium 4.4
SQLBot through 1.10.3 Weak Password Hashing via Unsalted MD5
SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrat…
-
Medium 6.9
AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to que…
-
Medium 5.3
Gameyfin before 2.6.2 Missing Authorization in Hilla Endpoints
Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as Ga…
-
Medium 5.1
MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet…
-
Medium 6.9
BACnet Stack: Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested dec…
-
Medium 6.5
BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. …
-
Medium 6.9
Zenitel Connect web interface serves production JavaScript source maps without authentication
The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the…
-
Medium 6.9
Zenitel Connect login allows account-lockout denial of service
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as lo…
-
Medium 6.3
Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel
Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in whi…
-
Medium 6.3
Refused calls drain the HTTP/2 connection flow-control window in elixir-grpc grpc_server
Missing Release of Resource after Effective Lifetime vulnerability in elixir-grpc grpc_server allows a client to stall all later calls on a shared HTTP/2 connection via calls that the server refuses while their DATA frames are in flight. The stream handler gr…
-
Medium 6.0
A flaw in the automatic client-side encryption schema generation of the Mongoid ODM may cause values that an applicatio…
-
Medium 5.1
Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction
The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
-
Medium 6.9
Zenitel Connect login allows username enumeration via verbose error responses
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.
-
Medium 4.3
Dell PowerStore contains a content-injection vulnerability. An unauthenticated attacker could exploit this vulnerabilit…
-
Medium 6.5
In gittuf 0.10.0 through 0.15.0, when a minimum threshold global rule and a policy rule protect the same namespace, ver…
-
Medium 5.5
In gittuf 0.10.0 through 0.17.0, the verification workflow does not load policy updates that are propagated from an ups…
-
Medium 5.5
In gittuf before 0.18.0, verification of file protection rules uses the quoted, escaped pathnames that Git prints by de…