405,427 results · Feed
-
Low 2.3
compose-lint: .env read through a symlink outside the project can expose the CI job's environment
compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.31.0, compose-lint follows a sibling .env symbolic link outside the project without applying its normal containment check. From…
-
High 7.4
ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoder
Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine. Prior to 1.1.2, the bundled jpgd JPEG decoder accepts duplicate component selectors in an SOS scan header, causing each duplicate to increase m_blocks_per_mcu without checking the buf…
-
High 8.3
Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap
During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submi…
-
Low 2.4
OctoPrint: Stored XSS via saved connection parameters
OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists the…
-
Critical 9.3
Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remot…
-
High 7.1
WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8.
-
High 7.1
WordPress Broadcast Live Video plugin <= 7.3.14 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Reflected XSS.This issue affects Broadcast Live Video: from n/a through …
-
Medium 4.3
WordPress WPBruiser {no- Captcha anti-Spam} plugin <= 3.6.2 - Broken Authentication vulnerability
Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2.
-
High 8.8
WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1.
-
High 7.1
Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations.
-
High 7.5
Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server
Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service.
-
High 7.7
Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server
Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope.
-
Medium 6.3
Folder Permission Bypass in Progress WS_FTP Server
Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users.
-
Medium 6.5
FTP Quota Accounting Bypass in Progress WS_FTP Server
Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service.
-
High 8.1
Insecure XFT Transport in Progress WS_FTP Server
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
-
Medium 6.9
Disabled TLS Certificate Validation Enables MITM Attacks
The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications.
-
Medium 6.7
CVE-2026-121690
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative control of th…
-
High 7.5
CVE-2026-121689
FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diagnostic ex…
-
Critical 9.1
CVE-2026-121688
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the sa…
-
Critical 9.8
CVE-2026-121687
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join…
-
Critical 9.8
CVE-2026-121686
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemet…
-
Critical 9.8
CVE-2026-121685
FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials…
-
Medium 5.4
Time-of-check time-of-use (TOCTOU) race condition in Sandisk Dashboard Installer
A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated standard user to replace an installer-staged binary in a user-writable temporary directory between validation and execution. The elevated i…
-
Medium 6.6
Hardcoded AES Key Enables Credential Disclosure
The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext.
-
High 7.8
Disabled TLS Certificate Validation Enables MITM Attacks
Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the MQTT broker and access data or perform actions across tenant boundaries.
-
High 8.7
Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-i…
-
Low 2.0
In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages befor…
-
High 7.2
XSS vulnerability in OpenText Filr
XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack.
-
High 7.1
Nmaslib Hnswlib and Spotify Voyager HNSW Index Deserialization Heap Out-of-Bounds Write
The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count gr…
-
Medium 5.4
PrestaShop Performance Debug Configuration PHP Code Injection
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is…
-
High 7.3
SQL Injection in Database Migration via Stored Connector Identifiers in flowintel
A SQL injection vulnerability exists in a database migration script in flowintel. The migration process reads stored connector identifier values from the database and interpolates them directly into SQL statements without parameterization. An attacker who has…
-
High 8.5
PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)
A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.
-
Medium 6.3
`http.cookiejar` applies expired `Set-Cookie` to cookie store before policy validation
http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging …
-
High 7.8
Privilege Escalation in HAVELSAN's Liman Render Engine
Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81.
-
None 0.0
ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity
When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked.
-
Low 3.8
kevquirk PureBlog Page Editor content.php save_page path traversal
A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path travers…
-
High 8.8
An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager softw…
-
High 8.8
A remote code execution vulnerability exists in HPE Morpheus Software.
-
Medium 4.7
kevquirk PureBlog Admin Image Upload Endpoint upload-image.php unrestricted upload
A vulnerability was identified in kevquirk PureBlog up to 3.7.2. Impacted is an unknown function of the file admin/upload-image.php of the component Admin Image Upload Endpoint. Such manipulation leads to unrestricted upload. The attack may be launched remote…
-
Medium 6.3
PipraPay Admin Panel pp-functions.php deleteData sql injection
A security vulnerability has been detected in PipraPay 3.0.0. Affected by this issue is the function deleteData of the file pp-content/pp-include/pp-functions.php of the component Admin Panel. The manipulation of the argument selected_ids/ItemID leads to sql …