Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
8,004 results · Feed
-
High 8.1
Control Web Panel < 1.30.6 Authorization Bypass via oauth_authorization_codes
Control Web Panel (CWP) before webpanel_version 1.30.6 contains an authorization bypass vulnerability in the validate() function of api/v1/index.php that allows attackers holding a password-recovery token and a predictable legacy signature to obtain valid rem…
-
High 7.4
IBM ContextForge MCP Gateway is affected by an information exposure vulnerability
IBM ContextForge MCP Gateway 1.0.0 through 1.1.0 could allow an attacker to replay identity propagation claims signatures or expose sensitive user identity information to third-party MCP servers due to static signature payloads and missing per-gateway configu…
-
High 8.1CVE-2026-124020 Public exploit
Control Web Panel < 1.30.6 Host Header Password Reset Poisoning
Control Web Panel (CWP) before webpanel_version 1.30.6 contains a host header injection vulnerability that allows unauthenticated attackers to manipulate the password-recovery reset URL by injecting the HTTP Host header into the /v1/lostpass/ route's token ge…
-
Medium 6.2
A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to a…
-
High 7.0
Postecert FIRMAOK! 1.6.29 Local Privilege Escalation via OpenSSL Search Path
Poste Italiane Postecert FIRMAOK! 1.6.29 on Windows contains a local privilege escalation vulnerability caused by an uncontrolled OpenSSL search path, where launcher.exe and dependent executables such as updater.exe and tslupdater.exe load OpenSSL configurati…
-
High 8.4
Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Cont…
-
Low 2.5
IBM Cyber Fraud includes components with multiple known vulnerabilities
IBM Cyber Fraud 1.0.0 through 1.1.0 could allow a local attacker to bypass security restrictions due to a missing or misconfigured security context.
-
Medium 6.1
IBM Cyber Fraud 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated…
-
Medium 4.0
IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an attacker with local access to a container to extract sensitive infor…
-
Medium 5.3
IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an unauthorized user to inject data into log messages due to improper n…
-
Medium 5.5
A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, ru…
-
High 7.8
A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies…
-
Unscored —
Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlie…
-
Medium 5.9
The HashiCorp cap JWT validation library before version 0.14.0 is vulnerable to a claims validation bypass that may cau…
-
Unscored —
Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and e…
-
Medium 5.3
NLTK: Quadratic CPU exhaustion in LegalitySyllableTokenizer.tokenize via unguarded onset reversal loop
## Summary `LegalitySyllableTokenizer.tokenize` in the NLTK tokenizer package contains an unguarded O(n^2) processing loop. When the method is called on a single token that consists of a long run of vowels (for example `"a" * n`), it consumes CPU time proport…
-
Medium 6.2
Dbus: infinite cpu-spin loop in libdbus socket transport when epipe is received during write operations
A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors a…
-
Medium 5.5
Dbus: stack out-of-bounds write in dbus _dbus_poll() select() fallback when file descriptor exceeds fd_setsize
A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a…
-
Medium 6.4
Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route
Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplyin…
-
Critical 9.8
VITEC EZ TV Platform Server Unauthenticated File Upload via UploadHandler.ashx
VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that allows unauthenticated remote attackers to upload arbitrary files by supplying a target filename in the X-FILENAME request header with no au…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the WebSocket reader c…
-
Medium 6.5
Injection Guard WordPress Plugin < 1.4.0 CSRF Password Hash Disclosure
Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to trigger password hash export by tricking a logged-in administrator into loading a crafted link, since the ig_setting…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp decompresses e…
-
High 8.3
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, when the pipelined req…
-
High 8.2
AIOHTTP: Unbounded buffering of data received during an upgrade request
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, aiohttp buffers all additional connection data received while a request marked for upgrade, such as a WebSocket handshake, is being handled, without a size limit …
-
High 7.5
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the C WebSocket reader…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, BodyPartReader.read_ch…
-
High 8.7
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Request.post() does no…
-
High 7.1
Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the tic…
-
Medium 6.3
AIOHTTP: Unbounded cookie storage in client CookieJar
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Set-Cookie parsing treats unrecognized name=value attributes as additional cookies, while CookieJar does not limit the number of cookies stored or sent. A malicio…
-
Medium 6.8
Expired Vault login MFA requests may remain redeemable
Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests. This may allow a user who previously completed the first authentication factor to complete MFA and obtain a Vault token after the pending request should h…
-
High 8.2
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Application.add_domain…
-
High 8.5
- Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80, an…
-
Medium 6.5
Vault vulnerable to ACL deny bypass via case-variant auth method user and group names
Vault Community Edition and Vault Enterprise did not apply explicit ACL policy deny rules to letter case variants of user and group names in auth methods that treat these names as case-insensitive. This may allow an authenticated user with delegated permissio…
-
High 8.6
Kanbanz by Softaculous plugin for WordPress before 1.0.3 contains a broken access control vulnerability that allows aut…
-
Medium 5.9
SvelteKit: `@sveltejs/adapter-node` crashes when proxying certain requests via `fetch`
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 5.5.7 until versions 5.5.8 and 6.0.1, , @sveltejs/adapter-node can attempt to add a header to an immutable request in a context that causes the serv…
-
Medium 5.9
SvelteKit: Prerendered redirect paths can inject arbitrary rules into the `_redirects` file generated by `@sveltejs/adapter-cloudflare`
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 4.7.0 until versions 7.2.10 and 8.0.2, @sveltejs/adapter-cloudflare allowed an attacker-influenced link crawled during prerendering to place whitesp…
-
Medium 5.9
SvelteKit: Prerendered paths are interpreted as regular expressions in Vercel route config generated by @sveltejs/adapter-vercel and @sveltejs/adapter-static
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to @sveltejs/adapter-vercel 6.3.5 and 7.0.2 and @sveltejs/adapter-static 3.0.11 and 4.0.1, an attacker-influenced link crawled during prerendering could be…
-
High 7.5
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.42.0 u…
-
Medium 5.9
SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 2.60.1 u…