Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
3,147 results · Clear filters · Feed
-
Medium 4.3
OpenEMR before 8.5.0 CSRF via Observation Form delete.php
OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to …
-
Medium 5.4
OpenEMR before 8.5.0 Stored XSS via Printed Fee Sheet Appointment Comments
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the f…
-
Medium 5.4
OpenEMR before 8.5.0 Stored XSS via OnsitePortalActivity tableArgs
OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out o…
-
Medium 6.0
Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits, uploa…
-
Medium 6.9
Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthe…
-
Medium 6.9
Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by…
-
Medium 5.4
Zipline before 4.6.2 Missing Authorization via POST /api/user/folders
Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated users to reparent other users' files by supplying their file IDs. Attackers can harvest file IDs from public folders and create a folder se…
-
Medium 6.8
Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints
Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and …
-
Medium 6.9
Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment variab…
-
Medium 5.8
Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or…
-
Medium 5.4
Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags
Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embe…
-
Medium 5.4
Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls
Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary short URL destinations by abusing missing scheme validation in POST /api/user/urls. Attackers can store javascript: URIs or attacker-controlled…
-
Medium 6.9
Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw
Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET…
-
Medium 5.3
Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /ap…
-
Medium 5.3
OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build conf…
-
Medium 6.5
OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API
OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list and build from Git repositories restricted to other projects. Attackers can enumerate repositories via GET /api/v1/git_repo/?all=true and su…
-
Medium 4.3
OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id
OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link pipeline stages to environments of other projects by supplying a foreign project_env_id. Attackers can submit another project's environment …
-
Medium 5.3
Huginn from 2026.09.09 before 2026.11.09 contains a server-side request forgery vulnerability because OutboundProxy.con…
-
Medium 4.3
Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries from other users' collections by supplying arbitrary collectionName and creatorUserId values. Attackers can obtain user ids from the usersList …
-
Medium 5.3
Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to take over other us…
-
Medium 5.3
BuildAdmin 1.0.1 through 2.3.9 contains a stored cross-site scripting vulnerability that allows unauthenticated attacke…
-
Medium 5.5
Rustrak before 0.26.0 SSRF via Alert Integration Test routing_override.url
Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routing_override.url to POST /api/integrations/{id}/test. Attackers can ta…
-
Medium 6.5
FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode
FrankenPHP before 1.13.4 contains a use-after-free vulnerability in worker mode that frees internal streams of SplTempFileObject or SplFileObject on php://temp instances surviving across requests. Remote clients can send requests reaching code that uses such …
-
Medium 6.3
FrankenPHP before 1.13.4 contains a denial of service vulnerability in worker mode where frankenphp_handle_request() re…
-
Medium 6.3
FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environ…
-
Medium 5.9
FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion
FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails to detect circular references in PHP arrays. Passing a self-referential array to frankenphp_log() or returning one from a worker callback tri…
-
Medium 6.9
FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP…
-
Medium 5.9
FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion
FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort the server process via arrays with null integer-keyed elements. Attackers can send crafted JSON passed to frankenphp_log() or returned from …
-
Medium 6.5
FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos
FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows unauthenticated attackers to execute protected PHP scripts by embedding .php inside a filename component. Attackers can request paths like /uploads/a.php.…
-
Medium 6.9
FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to …
-
Medium 4.7
OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options wi…
-
Medium 4.7
OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated att…
-
Medium 5.1
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization vulnerabil…
-
Medium 4.3
OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-…
-
Medium 4.4
OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information Required) payment method on orders with a non-zero total because the zero-total check runs only when payment data is imported. An API user with c…
-
Medium 6.9
OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the /rss/o…
-
Medium 6.9
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted …
-
Medium 6.9
Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows re…
-
Medium 5.3
Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder
Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that allows unauthenticated remote attackers to crash parsing applications. Attackers can send a single 833-byte packet with 250 nested ASN.1 SEQ…
-
Medium 5.5
GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers
GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers in src/compositor/mpeg4_form.c that lets attackers crash the process via unchecked group lookups. Attackers can supply a crafted XMT scene wh…