405,219 results · Feed
-
Unscored —
Cgo directive injection via .syso files disguised as Go object files in cmd/go and cmd/link
Building a package containing a crafted ".syso" file could bypass cgo flag validation and inject arbitrary linker flags when linking. When loading ".syso" entries from a package archive, the linker only checked for recognized host object headers (ELF, Mach-O,…
-
Unscored —
Flag sanitization bypass via "#cgo pkg-config:" directives in cmd/go
Building a malicious package that uses "#cgo pkg-config:" directives could load untrusted pkg-config ".pc" files or inject unvalidated compiler and linker flags. The pkg-config flag allowlist previously permitted "--with-path=" and "--personality=", allowed "…
-
Unscored —
Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go
Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries…
-
Unscored —
Unexpected code execution via escaped quotes in //go:cgo_ldflag in cmd/go and cmd/compile
Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution at build time, or cause the go command to panic, via crafted quoting in "//go:cgo_ldflag" directives. When "cmd/cgo" generates "_cgo_gotypes.…
-
High 7.1
LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes
LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and SPSS-response export workflow. An authenticated user with global surveys.create permission can import a crafted .lsa archive whose particip…
-
High 8.1
node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF
node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer. Prior to version 0.7.7, a crafted font could trigger a heap out-of-bounds write in RenderSDF (include/mapbox/glyph_foundry_impl.hpp). Ren…
-
High 7.0
Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify Object.…
-
Medium 6.3
Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that n…
-
Medium 5.1
Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that r…
-
High 7.1
Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdater::userM…
-
Medium 5.1
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the Elas…
-
Medium 5.3
Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore Co…
-
Medium 5.3
Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::ge…
-
Medium 5.1
Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::getFormat…
-
Medium 5.3
Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore ConceptDescr…
-
Medium 5.1
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables integratio…
-
High 7.1
Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the ed…
-
Medium 4.8
Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::profiles(…
-
High 8.7
OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version…
-
High 7.1
OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version…
-
Medium 4.3
Viber for iOS through 29.4.0.24 Denial of Service via Malformed GIF
Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing attackers to crash the app. Attackers can send a crafted GIF with zero dimensions that triggers an uncaught NSInternalInconsistencyExceptio…
-
Medium 4.3
WWBN AVideo through 29.7.1 Missing Authorization via get_api_tags API
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php that allows registered users to access restricted video data by querying the tags API. Attackers can subscribe to a tag and query APIName=ta…
-
Medium 4.3
WWBN AVideo 6.5 through 29.7.1 Email Verification Bypass via User::verifyCode()
WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in objects/user.php caused by PHP loose comparison of the recoverPass token. Registered users can reuse the installation-wide salt from their own verifica…
-
High 7.5
WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php
WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-p…
-
Critical 9.8
WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login
WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user via Hybridauth social login display names. Attackers can set their X, Facebook, Yahoo or LinkedIn display name to a vict…
-
High 8.1
WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints
WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows authenticated streamers to obtain other users' stream keys by supplying arbitrary live_transmitions_history_id values. Attackers can redeem…
-
High 8.1
Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface
Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthReque…
-
High 7.4
Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints
Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /Library/VirtualFolders/Name endpoints that allows attackers to delete or move directories via unvalidated library names. Unauthenticated attackers can…
-
Medium 5.4
WriteFreely before 0.17.3 Stored XSS via Unsanitized Post Slug
WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination…
-
High 7.8
LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage
LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgReader18::parseDataPage() function due to unchecked buffer size and page offsets. Attackers can craft an AC1018 (R2004) DWG file with malicious startOf…
-
Medium 4.3
1Panel-dev CordysCRM before 1.9.6 Authorization Bypass via /account/contact/get/{id}
1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that allows authenticated users to read other users' contacts because no organization, owner or data-scope check is applied. Attackers holding or…
-
Medium 6.1
MQTTX through 1.13.3 Stored XSS via Topic Tree and JSON Tree Tooltips
MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject script by publishing malicious MQTT topic names or payloads rendered unescaped in tooltips. Attackers controlling a broker or publishing to subsc…
-
Unscored —
Janus WebRTC Server 1.2.3 through 1.4.0 is vulnerable to Directory Traversal. The application accepts a caller supplied…
-
Low 3.7
Active Storage: Possible local file disclosure in Active Storage video previews and analysis
Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::Vi…
-
Medium 4.3
ISE Authorization Bypass vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side valida…
-
Critical 9.5CVE-2026-126187 Public exploit
React: Unauthenticated Remote Code Execution in React Server Components
React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code exe…
-
Medium 4.6
Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disa…
-
Critical 9.0
A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7…
-
High 8.4
Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentia…
-
Medium 6.8
Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a…