Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
3,147 results · Clear filters · Feed
-
Medium 6.8
NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths
NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weigh…
-
Medium 6.3
NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypass…
-
Medium 6.9
NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop
NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causi…
-
Medium 6.9
NLTK: Quadratic CPU exhaustion in TreebankWordTokenizer.span_tokenize via list.pop(0) in quote-restore loop
NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-…
-
Medium 5.8
OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates
OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typicall…
-
Medium 5.3
Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record ty…
-
Medium 4.3
REDAXO before 5.21.6 Authorization Bypass of Live Version Permission
REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the version[live_version] permission to modify live article versions by bypassing working version enforcement. Authenticated editors can add, edit, delete, toggle,…
-
Medium 6.5
Dockhand before 1.0.55 Arbitrary File Read via Stack Adoption Compose Path
Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create permission to read sensitive files by supplying an arbitrary composePath during stack adoption. Attackers can adopt a stack pointing to the…
-
Medium 5.1
Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor u…
-
Medium 4.3
Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions
Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in ad…
-
Medium 5.4
Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys
Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates admin_auth_token array keys into an INSERT column list without a column whitelist or backtick escaping. Authenticated admin-panel users can subm…
-
Medium 5.3
Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action t…
-
Medium 5.3
Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as ba…
-
Medium 5.4
Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets
Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to access other users' records by bypassing admin_id owner scoping. Attackers can supply filter[admin_id] to list drafts, invoke duplicate() o…
-
Medium 4.9
n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector Sto…
-
Medium 6.3
n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that accept…
-
Medium 4.8
n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the …
-
Medium 5.3
n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool
n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files by supplying absolute paths to the Browser Use browser_upload tool. Attackers with a connected remote browser session can have Playwright re…
-
Medium 5.1
n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect vulnerabil…
-
Medium 6.3
n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API…
-
Medium 6.3
n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated att…
-
Medium 6.9
vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which use…
-
Medium 5.3
SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fe…
-
Medium 5.3
vLLM 0.14.0rc1 before 0.31.0 Heap Address Disclosure via sanitize_message()
vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, …
-
Medium 5.3
vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels
vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when ma…
-
Medium 6.5
vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames
vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the server frame limit by setting media_io_kwargs.video.num_frames in chat completion requests. Attackers can supply num_frames=-1 or a large v…
-
Medium 6.5
Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint
Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 contains an improper authorization flaw in the external agent credentials endpoint, which returns the workspace agent token to users with…
-
Medium 6.8
Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation
Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before 2.38.4 does not restrict new API keys to the creating token's scopes, allow list, or expiry. A scoped API key or OAuth2 token holding key-creati…
-
Medium 6.3
wasi-http p2: outgoing content-length can be invalid or not match body
The wasmtime-wasi-http p2 implementation in Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 can send conflicting content-length headers, or ones not matching the body, in outgoing requests. A guest that reuses a r…
-
Medium 4.8
Wasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer
Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host memory when a component receives a borrow of a resource it defines itself, bypassing the per-store handle limit. A malicious guest component…
-
Medium 5.3
wasip3 UDP `send` can deliver a datagram to an address only allowed for receiving
Wasmtime's wasmtime-wasi crate 48.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a time-of-check/time-of-use race in the wasip3 wasi:sockets udp-socket host implementation that lets guests bypass socket_addr_check send restrictions…
-
Medium 5.4
Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints
Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated users access records they are not permitted to view. Any logged-in user, including one with only the Employee role, can read candidate record …
-
Medium 5.3
Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint t…
-
Medium 6.5
OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any authenticated user to retrieve patient demographic records. Attackers can send direct requests with wildcard mf_lname or empty mf_ parameters …
-
Medium 6.9
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, whic…
-
Medium 6.0
OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in th…
-
Medium 5.4
OpenEMR before 8.5.0 Missing Authorization in E-Sign Form Submission
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of library/ESign/Form/Controller.php that verifies only the caller's password, not access to the patient, encounter, or form type. Authenticated core users ca…
-
Medium 5.3
OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with p…
-
Medium 5.9
OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation
OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows read-only demographics users to create patient charts. Attackers can submit the form_create request with chosen identity fields to create fictit…
-
Medium 5.3
OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows restric…