405,824 results · Feed
-
Low 3.3
Gitleaks through 8.30.1 World-Readable Report Files via --report-path
Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local us…
-
High 8.1CVE-2026-124040 Public exploit
CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State
CivetWeb through 1.16, when built with USE_HTTP2 and enable_http2 on, contains a use-after-free vulnerability in handle_http2() that retains freed :method and :path pointers. Unauthenticated remote attackers can send a later HEADERS frame omitting these pseud…
-
Medium 5.5
GPAC through 26.07.0 Type Confusion via drawable_get_aspect_2d_mpeg4
GPAC through 26.07.0 contains a type confusion vulnerability in drawable_get_aspect_2d_mpeg4() and TraverseShape() that casts a Shape's appearance node to M_Appearance without checking its node tag. Attackers can supply a crafted XMT file placing another node…
-
Medium 5.7
Kopia through 0.23.1 Path Traversal in Snapshot Restore via Directory Entry Names
Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are na…
-
Medium 5.5
GPAC through 26.07.0 Type Confusion via gf_sg_command_apply XMT Field-Replace
GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such…
-
Medium 4.2
mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers
mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags …
-
Medium 4.3
Bar Assistant 6.0.0-rc1 before 6.11.0 Incorrect Authorization via Cocktail Copy
Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with othe…
-
High 7.5
ChatWiki before 2.10.0 Unauthenticated Document Disclosure via getLibRawFileOnePage
ChatWiki before 2.10.0 contains a missing authentication vulnerability in the GET /manage/getLibRawFileOnePage route that allows unauthenticated attackers to read other tenants' documents. Attackers can enumerate sequential admin_user_id and file id query par…
-
Medium 4.3
Faveo Helpdesk through 2.0.3 Cross-Department Ticket Disclosure via /ticket/print
Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability in TicketController::ticket_print and the pdfThread endpoint that fails to verify ticket department or assignment. Authenticated agents can request arbitrary ticket ids via GET /ticke…
-
Medium 5.1
A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions c…
-
Medium 5.9
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication…
-
Medium 5.9
A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authenticatio…
-
High 7.5
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an al…
KEV Nov 6, 2026 -
High 8.3
Hisense VIDAA Smart TV MQTT Broker Authentication Bypass
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate l…
-
Medium 6.5
Hisense VIDAA Smart TV Unauthenticated DoS via SetAVTransportURI
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated denial-of-service vulnerability in the UPnP/DLNA AVTransport SOAP service that allows LAN-adjacent attackers to freeze the entire television software layer by sending a crafted Set…
-
Medium 4.6
Hisense VIDAA Smart TV UPnP/DLNA Missing Authentication
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a missing authentication vulnerability in the UPnP/DLNA RenderingControl service on TCP port 38400 that allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPreset(FactoryDefaults) c…
-
Medium 4.6
Hisense VIDAA Smart TV SSRF via SetAVTransportURI CurrentURI
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an input validation vulnerability in the UPnP/DLNA AVTransport SOAP service that allows a LAN-adjacent attacker to inject arbitrary URIs via the CurrentURI field of SetAVTransportURI without validati…
-
Medium 6.3
Hisense VIDAA Smart TV DIAL Service Unauthenticated Access
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or u…
-
High 7.5
A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which…
-
High 8.8
Hisense VIDAA Smart TV Unauthenticated WebDriver Remote Access
Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authent…
-
High 8.8
A session validation vulnerability has been identified in the SonicOS management interface, which in specific condition…
-
High 8.8
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specif…
-
High 8.1
Out-of-Bounds Read in Babelfish for PostgreSQL TDS RPC Procedure-Name Parser
An out-of-bounds read in the TDS RPC procedure-name parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote authenticated users to read adjacent …
-
None 0.0
GROBID is vulnerable to OS command injection through crafted PDF filenames
GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java passes an attacker-influenced PDF filen…
-
Medium 4.3
CVE-2026-122113
A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a physically present attacker using a maliciously crafted USB device to trigger unbounded recursion in the driver's topology-parsing logic during device enumeration. Processing the crafted desc…
-
High 7.8
CVE-2026-90975
A vulnerability in Realtek's RtUsbA64.sys USB audio driver allows a local, low-privileged user to abuse a kernel I/O control (IOCTL) interface that acts on a caller-supplied user-mode pointer without proper validation or capture. By issuing crafted property r…
-
Critical 9.8
Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser
A heap-based buffer overflow in the TDS prelogin parser in the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 and in Amazon Aurora PostgreSQL with Babelfish might allow remote attackers to execute arbitrary OS comman…
-
High 7.5
GROBID: Unauthenticated `/api/modelTraining` Endpoint Allows Unbounded Thread Pool Creation (DoS)
GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the unauthenticated /api/modelTraining endpoint calls GrobidRestProcessTraining.trainModel in GrobidRestProcessTraining.java, where each request creates E…
-
Medium 6.5
DDEV incomplete tar symlink traversal fix allows host file overwrite - Incomplete fix of CVE-2026-32885
DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the…
-
Critical 9.8CVE-2026-84473 Public exploit
CVE-2026-84473
Authentication Bypass / Missing Brute-Force Protection in remote.php/webdav/ in ownCloud ownCloud server 10.16.3 allows an unauthenticated remote attacker to perform unlimited online password guessing against WebDAV accounts via repeated HTTP Basic Authentica…
-
High 7.8
xen-netback: defer xenvif_mcast_addr_list_free()
In the Linux kernel, the following vulnerability has been resolved: xen-netback: defer xenvif_mcast_addr_list_free() In order for the function to legitimately avoid locking/RCU, it needs to run after all TX/RX processing has finished/stopped: Lookups happen f…
-
Unscored —
xen-blkback: Avoid UAF when reading I/O statistics
In the Linux kernel, the following vulnerability has been resolved: xen-blkback: Avoid UAF when reading I/O statistics Reading I/O statistics via sysfs concurrently with tearing down a frontend device might result in UAF or a NULL dereference, as the reading …
-
Unscored —
xen-netback: Fix UAF when reading statistics data
In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix UAF when reading statistics data The network statistic data in the driver is protected by RCU. Unfortunately when tearing down the queues after an error during connecting to …
-
Critical 10.0
Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.20.0, when PUBLIC_PRIVATE_INSTANCE is not set to true, the unauthenticated POST /api/v1/trail/download handler passes the attacker-controlled JSON url field directly to eve…
-
High 7.6
Wanderer: Stored XSS via waypoint.name and waypoint.icon in Elevation Profile innerHTML
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated local user can submit crafted waypoint.name and waypoint.icon values that the trail elevation graph interpolates into an innerHTML template in web/sr…
-
High 7.6
Stored XSS via Unsanitized waypoint.icon in Map Marker (insertAdjacentHTML)
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, an authenticated user can store a crafted waypoint.icon value that createMarkerFromWaypoint() passes into FontawesomeMarker, where insertAdjacentHTML inserts the unva…
-
Medium 5.5
EDFbrowser before 2.16 Out-of-Bounds Write via check_edf_file() Annotation Signals
EDFbrowser before 2.16 contains an out-of-bounds write vulnerability in check_edf_file() that allows attackers to overflow the 256-element annot_ch array by supplying excessive annotation signals. Attackers can craft an EDF+ or BDF+ file with more than 256 an…
-
High 7.5
Wanderer: Unauthenticated Access to Private Trails and Comments via ActivityPub Endpoints
Wanderer is a self-hosted trail database for saving and sharing adventures. Prior to 0.19.3, the unauthenticated GET /activitypub/trail/{id} and GET /activitypub/comment/{id} endpoints call ActivitypubTrail() and ActivitypubComment() to return full trail and …
-
Medium 6.3
Gradle Shadow: Zip Slip path traversal in ShadowCopyAction — no independent entry-name sanitization
The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cau…
-
High 7.5
Skyline DataMiner BrokerGateway Embedded API Key Authentication Bypass
Skyline DataMiner BrokerGateway contains an embedded API key vulnerability that allows unauthenticated attackers to retrieve the installation-specific BrokerGateway key even while pairing mode is disabled. Attackers can use the retrieved key to obtain the unr…