Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
8,038 results · Feed
-
Medium 5.3
Nuxt exposes the message and data of unhandled errors thrown during server rendering
Nuxt is an open-source web development framework for Vue.js. From 3.0.0 until 4.6.4, Nuxt wraps non-HTTP errors thrown during server rendering with createError and incorrectly treats the result as an error deliberately exposed by the application. In productio…
-
Medium 6.9
Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.4, _payload.json URL generation and t…
-
Low 3.1
Nuxt is an open-source web development framework for Vue.js. From @nuxt/webpack-builder 3.0.0 and @nuxt/rspack-builder …
-
High 8.4
Dnf5: dnf5daemon-server: dnf5daemon-server: unauthenticated privileged cmdline package fetch/open via add_cmdline_packages
A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local pat…
-
Medium 6.5
Nuxt is an open-source web development framework for Vue.js. Nuxt from 3.0.0 until 4.6.4, @nuxt/nitro-server from 3.20.…
-
High 8.8
paicoding from commit b8206b9 through commit 903adce uses predictable credentials for accounts created via ZSXQ login, …
-
Medium 5.1
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageService…
-
Medium 5.4
paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications
paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticate…
-
Medium 5.1
paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user…
-
High 8.7
paicoding 1.0.3 contains a missing authorization vulnerability in the ArticleRestController article detail endpoint tha…
-
High 8.7
SurveyKing 1.13.2 contains a missing authorization vulnerability in result lookup: the anonymous survey view leaks the …
-
Medium 5.3
paicoding 1.0.3 contains a payment bypass vulnerability that allows authenticated attackers to unlock paid articles by …
-
Medium 5.3
SurveyKing 1.12.0 through 1.13.2 Authentication Bypass via saveAnswer Response Submission
SurveyKing 1.12.0 through 1.13.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to submit survey responses because AnswerServiceImpl.saveAnswer skips login-required and survey password checks. Attackers can submit respon…
-
High 7.1
SurveyKing 1.12.0 through 1.13.2 contains an authorization bypass in the linked survey feature that fails to verify the…
-
Medium 5.1
DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter commen…
-
Medium 5.3
SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a resp…
-
Medium 5.4
DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions
DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payloa…
-
Medium 5.1
ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by …
-
Medium 5.3
ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any logged-…
-
High 7.1
free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the …
-
High 7.4
Dromara free-fs 2.0.1 through 2.3.1 Password Reset Code Brute-Force Account Takeover
Dromara free-fs 2.0.1 through 2.3.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute-force six-digit password reset codes via PUT /apis/user/forget-password. Attackers can request a code …
-
High 8.2
Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview tha…
-
High 8.2
Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access code…
-
Medium 5.1
Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users t…
-
Critical 9.1
Tactical RMM 0.17.0 through 1.6.1 Arbitrary File Read via Report Preview
Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because WeasyPrint resolves file:// links in user-supplied template_md and embeds the files in the returned PDF. Users with report management permi…
-
Critical 9.2
Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability t…
-
High 7.1
Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts bra…
-
Medium 5.3
PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endp…
-
Medium 5.4
PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when…
-
Critical 9.3
NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to …
-
Medium 5.3
FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which re…
-
Medium 5.1
EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT /a…
-
Medium 5.9
Nuxt dev server serves files from a parent directory that contains a lockfile
Nuxt is an open-source web development framework for Vue.js. From 3.5.0 until 4.6.4, Nuxt can choose a parent directory as the default workspaceDir in either of two cases: a stray parent lockfile when the project is outside a Git repository and has no workspa…
-
Medium 4.7
rails-html-sanitizer: Possible XSS via shared scrubber state in concurrent calls
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Before 1.7.2, the HTML4 and HTML5 variants of Rails::HTML::SafeListSanitizer reuse one Rails::HTML::PermitScrubber across calls and mutate its tags and attributes without…
-
Medium 5.3
rails-html-sanitizer: Possible regular expression denial of service with certain configurations
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 through 1.7.1, Rails::HTML::PermitScrubber checks SVG href and xlink:href local references with a pattern whose line-start anchor and whitespace class cause an…
-
Critical 9.3
A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free accou…
-
Medium 6.9
Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against…
-
High 7.5
iDentalSoft website information exposure
Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.
-
Medium 5.4
Omnispace Agora Project 26.10.0 Broken Access Control via isAutor()
Omnispace Agora Project through 26.10.0 contains a broken access control vulnerability in which the isAutor() function in MdlObject.php grants accessRight=3 based solely on object authorship without verifying the user still belongs to the object's space. Atta…
-
Medium 6.3
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticat…