405,825 results · Feed
-
Medium 6.1
Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.15.0, the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events use frontend/server/k8s-helper.ts to include untrusted podname and podnames…
-
Medium 6.5
Kubeflow Pipelines: SQL injection through unvalidated pagination tokens in Kubeflow Pipelines API server
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server trusts structural SQL identifier fields decoded from the base64-encoded JSON page_token parameter before constructing list quer…
-
High 8.8
MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presign…
-
Medium 5.1
API keys, credentials, and configuration parameters embedded in the MatchPoint APK
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and …
-
Medium 5.0
Kubeflow Pipelines — API server fetches a caller-supplied pipelineURL without host validation
Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.17.0, the API server's pipeline and pipeline-version creation paths fetch a caller-supplied pipelineURL without restricting the destination. An auth…
-
Critical 9.1
Incorrect validation of TLS certificates in the MatchPoint Android app
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victi…
-
High 8.1
Rucio: Authorisation Bypass on REST API endpoint for signing URLs
Rucio is a scientific data management framework. From 1.16.1 until 35.9.0, 38.6.0, and 41.0.0rc1, the /credentials/signurl endpoint reads X-Rucio-Account instead of the account stored in request.environ['issuer'] by token authentication. Any authenticated low…
-
High 8.7
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Lin…
-
Medium 5.3
filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold
filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode…
-
High 8.6
SQL injection in the push notification handler of the MatchPoint Android app
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate…
-
Medium 6.9
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to…
-
Medium 5.8
filelock: StrictSoftFileLock follows a symbolic link swapped in at <path>.filelock and creates claim files in a directory another local user chooses
filelock is a platform-independent file lock for Python. From 3.30.0 until 4.2.1, On POSIX platforms, StrictSoftFileLock and AsyncStrictSoftFileLock validate the coordination directory in _ensure_protocol_directory but later reach the claims directory through…
-
Low 2.5
filelock: On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break
filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, soft lock classes on Windows read an existing marker with _read_lock_file and remove a stale marker through break_lock_file using pathname operations that wait for an oplock bre…
-
Critical 9.9
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to persona…
-
Low 3.3
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock and AsyncReadWriteLock on Windows use _connect to attach SQLite to the lock database by pathname, allowing another local account that can create adjacent names to …
-
Critical 9.9
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
-
Medium 5.3
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
filelock is a platform-independent file lock for Python. From 3.10.0 until 4.2.1, filelock on Windows ignores the mode argument for WindowsFileLock files and the ReadWriteLock SQLite database. A lock created with mode=0o600 receives the parent directory's inh…
-
Medium 6.8
LXC: lxc-copy host-context hostname update follows symlink
LXC is a userspace interface for the Linux kernel containment features used to create and manage system containers. In LXC 7.0.0 and earlier, lxc-copy and the public liblxc clone() API can follow attacker-controlled symbolic links while updating /etc/hostname…
-
Critical 9.8
BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure
BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information disclosure vulnerability that allows unauthenticated remote attackers to retrieve .macaroon credential files for an LND (Lightning Network Daemon) node. Attackers can use …
-
High 8.8
Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter
Dolibarr is an open-source enterprise resource planning and customer relationship management application. Prior to 22.0.5 and 23.0.1, there is a SQL injection vulnerability in the Third Party company update functionality. The application concatenates the loc…
-
Medium 6.9
Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small frame that declares a ve…
-
Medium 6.3
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText…
-
Medium 5.4
Heap buffer overflow in dBASE index import
LibreOffice includes a dBASE database driver, which reads dBASE tables and their .ndx index files when a folder of dBASE files is used as a data source. A heap buffer overflow existed when an index page was read. The number of entries recorded in a page was n…
-
High 7.8
In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM p…
-
High 7.1
A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering. This issue affects…
-
Medium 5.3
A vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Clickjacking. This issue aff…
-
High 8.0
Codex Desktop for Windows does not correctly check quotation marks in project paths from Windows Explorer. If a user se…
-
High 7.0
Stack-based buffer overflow in SafeNet Authentication Client SIS token engine
A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may cause a denial of …
-
Medium 6.5
ImageMagick before 7.1.2-35 and 6.9.13-60 Infinite Loop via SVG Decoder
ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that…
-
High 8.0
mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata
Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metadata. Attackers can decl…
-
High 8.0
ChatCLI before v1.215.2 Origin Validation Error via Unvalidated MCP OAuth Resource Indicator
ChatCLI before v1.215.2 contains an improper validation vulnerability in the MCP OAuth login flow that uses server-supplied Protected Resource Metadata as the resource indicator without checking it matches the configured server URL. A malicious MCP server can…
-
High 8.8
noname v1.11.2 through v1.11.6.1 Missing Authentication in Electron Local File Server
noname Electron desktop build v1.11.2 through v1.11.6.1 contains an unauthenticated local file server with wildcard CORS that allows malicious websites to read, overwrite, or delete installation files. Attackers can send cross-origin requests to /writeFile on…
-
Low 3.1
LibreTV before v2.21.2 SSRF Protection Bypass via DNS Rebinding
LibreTV before v2.21.2 contains a server-side request forgery vulnerability that allows authenticated users to bypass checkUpstreamAllowed() by exploiting unpinned DNS resolution in fetchWithSafeRedirects(). Attackers controlling authoritative DNS can return …
-
Low 3.7
EdgeChat before 2.20.3 Missing Authentication for Attachment Download via GET /files/:key
EdgeChat before 2.20.3 contains a missing authentication vulnerability in the GET /files/:key route that allows unauthenticated or banned users to download decrypted public-channel attachments because canAccessFile() accepts a null user id. Attackers holding …
-
Medium 6.5
accel-ppp before 1.15.0 Heap-based Buffer Overflow via oversized log lines in log_tcp/log_syslog/log_pgsql
accel-ppp before 1.15.0 contains a heap buffer overflow vulnerability in the tcp, syslog and pgsql log targets that allows unauthenticated remote peers to overflow fixed heap buffers by producing log lines exceeding LOG_MAX_SIZE. Attackers within client-ip-ra…
-
Medium 4.3
Posta before v0.18.0 SSRF via Webhook URL
Posta before v0.18.0 contains a server-side request forgery vulnerability that allows authenticated users with edit rights to make the backend send POST requests to internal destinations by creating webhooks with arbitrary URLs. Attackers can target loopback,…
-
Medium 6.1
NEURON through 9.0.2 Stack-based Buffer Overflow via CoreNEURON dataset tokens
NEURON (CoreNEURON) through 9.0.2 contains a stack buffer overflow vulnerability that allows attackers to corrupt stack memory by supplying over-long tokens in a crafted model dataset. Attackers can place oversized version or mechanism-name tokens in bbcore_m…
-
High 7.5
libnxml before 0.18.6 Stack-based Buffer Overflow via long multi-byte XML name
libnxml before 0.18.6 contains a stack-based buffer overflow vulnerability in src/nxml_parser.c that allows remote attackers to write past a 1024-byte stack buffer via long XML names. Attackers can supply XML or RSS feeds with a 1022-character element, attrib…
-
Medium 5.3
buku through 5.1.1 SSRF via bukuserver fetch_data and network_handle API
Buku (bukuserver) through 5.1.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server request internal hosts by supplying a url parameter to /api/fetch_data or /api/network_handle. Attackers can …
-
High 7.5
VRPN through 07.36 Out-of-bounds Write via SENDER_DESCRIPTION/TYPE_DESCRIPTION length index
VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can co…