Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
8,038 results · Feed
-
High 8.5
Omnispace Agora Project through 26.10.0 contains a SQL injection vulnerability that allows authenticated general admini…
-
Medium 5.3
Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to i…
-
Medium 6.5
Omnispace Agora Project 26.10.0 IDOR via reloadMailTypeId Parameter
Omnispace Agora Project through 26.10.0 contains an insecure direct object reference vulnerability that allows authenticated attackers to access another user's private mail by supplying a crafted reloadMailTypeId parameter to Ctrl::getCurObj() without a readR…
-
Medium 5.3
Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to redirec…
-
High 8.7
Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows unauthenticat…
-
High 8.1
Omnispace Agora Project 26.10.0 CSRF via Administrator Account Creation
Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote attackers to forge privileged actions such as administrator user creation by merging $_GET and $_POST parameters without requiring an anti-CSRF toke…
-
Medium 6.0
In Eclipse BaSyx Go Components versions up to and including 1.1.3, ABAC-enabled deployments match `ROUTE` access rules …
-
High 7.6
C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-m…
-
High 7.7
C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves…
-
High 7.6
C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attacke…
-
Medium 6.5
C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND
C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to AP…
-
Medium 6.9
C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows maliciou…
-
Medium 5.9
C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers …
-
High 7.7
C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicio…
-
Critical 9.2
C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell com…
-
High 8.8
C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies
C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send…
-
Critical 9.2
C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell…
-
Medium 4.4
SQLBot through 1.10.3 Weak Password Hashing via Unsalted MD5
SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrat…
-
Critical 9.2
C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious pe…
-
High 8.4
Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by s…
-
High 7.1
agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remot…
-
Medium 6.9
AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to que…
-
Low 2.3
MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescap…
-
Medium 5.3
Gameyfin before 2.6.2 Missing Authorization in Hilla Endpoints
Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as Ga…
-
Medium 5.1
MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet…
-
Low 3.7
picoquic before 2026.11.05.3e2e3d3 Integer Overflow via TIME_STAMP Frame Decoder
picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIME_STAMP values. Attackers on connections negotiating the TIM…
-
High 8.6
MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect …
-
High 8.2
Streaming request body limit enforced only after an 8 MB read in elixir-grpc grpc_server
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests. The streaming read clause of GRPC.Server.Adapters…
-
High 8.2
CPU exhaustion via a truncated gRPC message on streaming RPCs in elixir-grpc grpc_server
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside …
-
High 8.7
BACnet Stack: Remote unauthenticated DoS in `Life_Safety_Zone` `PROP_ZONE_MEMBERS` WriteProperty parsing
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a malformed but non-empty BACnet WriteProperty request can drive the official server demo into a non-terminating request-processing …
-
High 7.5
BACnet Stack: Remote Global-Buffer-Overflow Read in readpropm via Malformed ReadPropertyMultiple-ACK
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When rea…
-
Medium 6.9
BACnet Stack: Out-of-bounds read in lighting_command_decode (full APDU size passed to nested tag decoders)
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, lighting_command_decode in src/bacnet/lighting.c decodes its first field with the bounded apdu_size - apdu_len, but every nested dec…
-
Medium 6.5
BACnet Stack: Out-of-bounds read in BACnet/SC proprietary header-option decode (bvlc_sc_decode_proprietary_option)
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a BACnet/SC peer can trigger a heap out-of-bounds read (up to 3 bytes), pre-authentication, in the BACnet/SC header-option decoder. …
-
High 7.6
Path bindings ignored for gRPC Content-Types on transcoded routes in elixir-grpc grpc_server
Authorization Bypass Through User-Controlled Key vulnerability in elixir-grpc grpc_server and grpc allows an attacker to make a handler act on a resource other than the one named in the URL of an HTTP-transcoded route, via a request with a gRPC Content-Type. …
-
High 8.6
BACnet Stack: Remote global-buffer-overflow in apps/router-ipv6/main.c routed APDU forwarding path
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a remote global-buffer-overflow in the official router-ipv6 application shipped with bacnet-stack, this results in an out-o…
-
High 7.5
Huatian OA8000 Path Traversal via ntkodownload.jsp
Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory…
-
High 7.5
BACnet Stack: bacnet_device.c stack-use-after-return in writable Device string properties
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) …
-
High 7.5
BACnet Stack: Denial of Service (Infinite Loop) in handler_read_property_multiple via malformed RPM requests
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a Denial of Service (DoS) vulnerability exists in the BACnet stack's ReadPropertyMultiple (RPM) handler. When processing a malformed…
-
High 8.8
BACnet Stack: Buffer overflows in bsc_node_parse_urls() (BACnet/SC Address Resolution ACK URL parser)
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the bsc_node_parse_urls() function in src/bacnet/datalink/bsc/bsc-node.c contains three distinct bugs when parsing space-separated W…
-
High 7.5
BACnet Stack: Global APDU transmit buffer out-of-bounds write in device.address-binding response encoding via address_list_encode()
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0-rc2, a reachable out-of-bounds write exists when encoding the device.address-binding property. This issue has been patched in version…