406,114 results · Feed
-
Medium 6.9
User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or r…
-
High 7.0
Cortex-M module ports save a preempted user-mode module thread's registers through its unchecked stack pointer in privileged mode
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a preempted user-mode module thread's registers in privileged mode at addresses taken from the thread's stack pointer, without checking that pointer …
-
High 8.7
NULL pointer dereference in ICMPv6 Packet Too Big processing when the destination table is full
In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6 Packet Too Big handler uses the destination-table entry it adds without checking that the add succeeded. A sender on the network can fill t…
-
Medium 6.8
Module Manager loaders leave the manager mutex held when a module preamble's sizes overflow, blocking every later module operation
In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such …
-
High 8.8
Control Web Panel (CWP) < 1.16 File Write and Command Injection via phpini_editor
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module that allows attackers with access to the module to write attacker-controlled content to arbitra…
-
High 8.1
Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow (CWPUserIndex) that allows unauthenticated attackers to bypass authentication by exploiting a missing exit() call aft…
-
High 8.8
Control Web Panel (CWP) < 1.16 Path Traversal via services/users/index.php
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attackers to include arbitrary local PHP files by supplying an unsanitized module name parameter concatenated directly into an…
-
Medium 5.4
Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls
Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;…
-
Medium 5.4CVE-2026-120491 Public exploit
Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA se…
-
Medium 4.3
Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unp…
-
Medium 5.4
LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content
LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save text-editor, H…
-
High 8.8
Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command execute permission in one workspace can …
-
High 7.2
LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/se…
-
High 8.8
Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker permission in any workspace can control co…
-
Medium 5.5
Kvazaar through 2.3.2 Infinite Loop DoS via Y4M Header Parser
Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. Attackers can provide a crafted .y4m file lacking a terminating newline…
-
High 7.4
python-jose through 3.5.0 Authentication Bypass via Empty HMAC Key
python-jose through 3.5.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs because HMACKey and CryptographyHMACKey accept zero-length HMAC secrets. When an application's HS256/HS384/HS512 verification key res…
-
Medium 5.3
libaec through 1.1.7 Out-of-Bounds Read via m_se_decode() Second Extension Decoder
libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. Attackers can supply a crafted CCSDS 121.0/SZIP stream with 2^31 or …
-
Medium 6.1
L-SMASH through 2.14.5 Heap Out-of-Bounds Write via hdlr and url Boxes
L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Attackers can supply crafted MP4 or MOV files declaring hdlr or url box sizes larger than …
-
Medium 6.1
rapidyaml through 0.16.0 Out-of-Bounds Write via ParseEngine::_add_annotation()
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML with consecutive anchors or tags to overf…
-
Medium 5.5
The Sleuth Kit through 4.15.0 NULL Pointer Dereference via decmpfs LZVN Decompression
The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple…
-
Low 3.3
The Sleuth Kit through 4.15.0 Heap Out-of-Bounds Read via HFS+ decmpfs Header
The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in tsk/fs/hfs.c that reads the decmpfs header without checking attribute length. Attackers can supply a crafted HFS+ image with a com.apple.decmpfs att…
-
Medium 5.4
libgphoto2 through 2.5.34 Heap Out-of-Bounds Read/Write via jl2005c Thumbnail Conversion
libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that allows malicious USB cameras to corrupt heap memory via oversized thumbnail processing. Attackers can supply small allocation-table values and …
-
Medium 6.8
libgphoto2 through 2.5.34 Buffer Overflow via jl2005c Camera Driver
libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that allow malicious USB devices to corrupt memory by supplying an unbounded allocation table entry count. Attackers can connect a spoofed Jeilin J…
-
Medium 5.3
Outline before 1.12.0 Improper Access Control via Public Document Shares
Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read unpublished documents because the share loader ignores unpublished status. Attackers holding an existing share link can query shares.info, docume…
-
Medium 4.3
LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool
LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with read-only email_template.view permission to send arbitrary emails via the MCP send-email tool. Attackers can mint an MCP token and call send…
-
High 8.1
DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint
DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-privileged users to rebind their API key to another user's account. Attackers can set the userId field on their own key …
-
High 8.1
HotGo 2.8.4 through 2.15.1 Authentication Bypass via Client-Set SMS Verification Code
HotGo 2.8.4 through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose the SMS login verification code by supplying the Code field to /admin/sms/send. Attackers who know a user's mobile number can set a know…
-
Critical 9.4CVE-2026-120446 Scanner template
madong-admin-saas through 5.1.4 Missing Authentication via Platform Tenant Management API
madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/ten…
-
High 8.8
madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware
madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant users to access the platform management API in multi-tenant mode. Attackers can reuse a tenant login JWT against /platf…
-
High 8.1
GoFound through 1.4.1 Path Traversal via database parameter in /api/db/drop
GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by supplying ../ sequences in the database parameter. Attackers can send GET requests to /api/db/create and /api/db/drop, direc…
-
Medium 6.1
GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results
GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts by submitting document text to /api/index. Attackers can index malicious HTML that searcher/engine.go returns unescaped and dash…
-
Critical 9.8CVE-2026-120442 Scanner template
ape-volo-admin before 3.6.1 Hardcoded JWT Signing Key Authentication Bypass
ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key in appsettings.json. Attackers can sign tokens offline with the jti claim set to …
-
Medium 5.3
OwnTone Server through 29.3 SQL Injection via MPD sticker find Command
OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote attackers to inject SQL via the URI argument. Attackers can send a crafted 'sticker find song' command to the MPD listene…
-
Medium 5.3
QuickJS-NG before 0.16.0 Memory Leak via Atomics.store
QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the converted value when returning a RangeError. Attackers running JavaScript can repeatedly call Atomics.store with a valueOf that detaches or…
-
High 7.0
QuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a comparator on a typed…
-
High 7.8
QuickJS-NG before 0.16.0 Heap Buffer Overflow via Proxy ownKeys Enumeration
QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a heap buffer overflow on 32-bit hosts. Attackers running JavaScript can return a large array-like object from a Proxy ownKeys trap to wrap the…
-
Medium 6.1
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Out-of-Bounds Read via tgatoppm
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in the tgatoppm converter's get_pixel() function that uses unchecked pixel values as color map indexes. Attackers can supply a crafted color-m…
-
High 7.8
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow via jbigtopnm
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that causes heap buffer overflow when computing output buffer size. Attackers can supply a crafted multi-plane JBIG file with large header dimens…
-
High 7.8
Netpbm before 10.86.51, 11.02.30, and 11.15.08 Heap Overflow in xpmtoppm
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm caused by an unvalidated characters-per-pixel value in the XPM header. Attackers can supply a crafted XPM file with characters-per-pixel greate…
-
High 7.8
Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Buffer Overflow via paintPoly
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the picttoppm paintPoly() function due to an unbounded polygon point count. Attackers can supply a crafted PICT file with a polygon exceeding 100…