406,076 results · Feed
-
Medium 5.9
WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected ses…
-
High 8.3
FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to re…
-
Medium 5.9
cordova-plugin-advanced-http 1.5.0 through 3.3.1 Cookie Leak via Cross-Origin Redirects
cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts because the JavaScript layer passes jar-built Cookie headers as ordinary request headers. When a request is redirected to…
-
High 7.5
Foxel through 2.4.0 Unauthenticated File Read via /api/fs/stream and /api/fs/thumb
Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full fi…
-
Medium 4.8
Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())
Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compu…
-
Medium 5.4
PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the scr…
-
Medium 4.3
domain-admin before 1.6.79 Missing Authorization via getGroupUserList
Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList handler that allows authenticated users to read other groups' members. Attackers can enumerate sequential group_id values to disclose member us…
-
Low 3.3
nnn through 5.3 Symlink-Following Write via NNN_FIFO Handling
nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because main() accepts an existing NNN_FIFO path without verifying it is a FIFO. Attackers can pre-create the documented predictable /tmp/nnn.fifo …
-
Medium 4.4
nnn through 5.3 Insecure Temporary File Symlink Overwrite via pdfread and nuke Plugins
nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local attackers to overwrite files by exploiting predictable paths in /tmp. Attackers can pre-create a symlink at the name-derived or PID-derived pat…
-
High 7.8
nnn through 5.3 OS Command Injection via togglex Plugin
Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into…
-
Low 2.2
dysk before 3.8.2 Terminal Escape Sequence Injection via Mount Metadata
Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject control sequences by crafting mount metadata rendered unsanitized in table and CSV output. Attackers can create FUSE mounts with ESC/OSC sequ…
-
Medium 5.9
ruTorrent before 5.3.20 Path Traversal via datadir Plugin Symlink Following
ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users to escape the topDirectory jail because correctDirectory() does not resolve symbolic links. Attackers can submit a datadir path through a sym…
-
Medium 4.9
Koodo Reader through 2.4.6 Path Traversal via OPDS Cover and Download Handlers
Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value contai…
-
Medium 6.5
Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler
Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged …
-
High 8.8
smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation
smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign the…
-
Low 3.7
Padloc before 4.3.1 Missing SCIM Token Validation via SCIM GET Requests
Padloc before 4.3.1 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows unauthenticated attackers to read SCIM directories by sending any non-empty bearer token. Attackers who know an organization id can query the Users …
-
Medium 5.4
DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save
DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGIN_PERMISSIONS because test() and save() never call testConnectionPermission. Attackers can submit arbitrary connection defin…
-
Low 2.7
SQLBot through 1.10.3 Path Traversal via datasource importToDb Endpoint
SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV…
-
Medium 6.5
bbs-go through 4.4.6 Improper TLS Certificate Validation in SMTP Email Service
bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN …
-
High 8.8
AB Download Manager before 1.11.2 Arbitrary File Write via /start-headless-download CSRF
AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain req…
-
High 7.5
CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID
CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the pass…
-
Medium 5.9
Heap exhaustion via unbounded simple string or bulk string allocation in Vert.x Redis client
In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an EOL-terminated line (not length-prefixed, for example a simple string [1]), we'll keep growing the buffer without bounds, eventually leading to an …
-
Medium 6.9
An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS …
-
Medium 5.2
An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a spe…
-
Medium 5.2
An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to suppl…
-
Medium 5.2
A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local ac…
-
Medium 5.1
An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a speci…
-
Medium 6.9
A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of ser…
-
Medium 6.5
runZero search SQL injection
A specially crafted malformed search query could return results from outside a user's organization. Log analysis of runZero's hosted environment found only testing of the issue and no adversary traffic. This issue was fixed in version 5.1.261013.1.
-
High 7.5
CachingWebClient shares user-specific HTTP responses across users via the shared cache tier
In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable an…
-
Medium 4.3CVE-2026-118527 Exploited
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticat…
KEV Oct 30, 2026 -
Medium 6.5
Dockhand 1.0.47 before 1.0.54 Secret Disclosure via Git Stack Webhook
Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start…
-
High 8.3
Dockhand before 1.0.54 Path Traversal via Stack Environment Routes
Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/e…
-
Medium 6.1
svg-sanitizer before 1.1.0 XSS via animateTransform on Safari
svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets t…
-
Medium 4.3
svg-sanitizer 0.5.0 before 1.1.0 Incomplete url() Filtering in SVG Attributes
svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass remote URL removal by using CSS escape sequences inside url() in SVG presentation attributes. Attackers can supply SVG files with attributes l…
-
Medium 5.9
svg-sanitizer 1.0.0 before 1.1.0 ReDoS and Fail-Open via image-set CSS Stripping
darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set t…
-
High 7.5
svg-sanitizer 0.11.0 before 1.1.0 Algorithmic Complexity DoS via use Reference Graph
svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elemen…
-
Medium 5.3
svg-sanitizer from 1.1.0 before 1.1.1 Denial of Service via Unclosed Tag
svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash requests by submitting SVG input ending inside an unclosed tag. Attackers can upload truncated input like a single '<' to trigger an uncaugh…
-
Medium 4.3
Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API
Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other employees' expense advance details due to improper authorization checks. Attackers can query the Expense Claim Advances API to retrieve exp…
-
Low 3.7
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 Forwarded Trailers Header Filter Bypass
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidd…