Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from more than 20 public sources, updated hourly.
- Tracked
- 409,241
- Last 24h
- 581
- Critical, 7 days
- 356
- Known exploited
- 1,779
107,946 results · Clear filters · Feed
-
Medium 5.6
An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content…
-
Medium 5.3
nipy nibabel Header volumeutils.py array_from_file memory allocation
A security vulnerability has been detected in nipy nibabel up to 5.4.2. The affected element is the function array_from_file of the file nibabel/volumeutils.py of the component Header Handler. The manipulation leads to uncontrolled memory allocation. The atta…
-
Medium 6.5
Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrar…
-
Medium 5.1
Insecure permissions in Mission Control / AIMSICD versionCode 2026080501 allows unauthorized attackers to invoke an exp…
-
Medium 6.5
Insecure permissions in the MirakelInternalContentProvider component of Mirakel v3.0 (versionCode 60) allows unauthoriz…
-
Medium 6.5
Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows una…
-
Medium 5.3
A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows at…
-
Medium 6.5
SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get…
-
Medium 5.3
nschloe meshio VTK Reader _vtk_42.py memory allocation
A weakness has been identified in nschloe meshio up to 5.3.5. Impacted is an unknown function of the file meshio/_vtk_42.py of the component VTK Reader. Executing a manipulation of the argument DIMENSIONS can lead to uncontrolled memory allocation. The attack…
-
Medium 5.3
dfm feedfinder2 feedfinder2.py find_feeds server-side request forgery
A security flaw has been discovered in dfm feedfinder2 up to 0.0.4. This issue affects the function find_feeds of the file feedfinder2.py. Performing a manipulation results in server-side request forgery. Remote exploitation of the attack is possible. The pro…
-
Medium 5.9
A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API witho…
-
Medium 4.3
maotoumao MusicFreeDesktop Request Forwarder information disclosure
A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the …
-
Medium 6.5
Objects API: Cross-object-type authorization bypass on the object history-detail endpoint
Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-…
-
Medium 5.3
InvoicePlane: Guest user IDOR in quote approval and rejection
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The `approve()` and `reject()` method…
-
Medium 5.4
Domoticz: Missing authorization and path traversal in the udevices Lua parser handler
Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lu…
-
Medium 6.3
maotoumao MusicFreeDesktop Request Forwarder server-side request forgery
A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. Impacted is an unknown function of the component Request Forwarder. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The explo…
-
Medium 5.5
a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes
A vulnerability was determined in a2ui-project a2ui up to 0.12.0. This issue affects the function Root.renderComponentTree of the file src/0.8/ui/root.js of the component Renderer. Executing a manipulation can lead to dynamically-determined object attributes.…
-
Medium 4.7
AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filename through `setTitle` in `encoder_queue.title` without neutralization. `fileURI` is not in the `objects/security.php` …
-
Medium 6.8
The DB Tools trust certificates issued by recoverable eMudhra intermediate CAs
The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates t…
-
Medium 6.1
AVideo-Encoder: reflected cross-site scripting in the login interface
AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without output encoding. In `view/index.php`, `webSiteRootURL` is returned verbatim by `Streamer::getStreamerURL()` in `objects/…
-
Medium 4.3
a2ui Image Player/Video Player/Audio Player Image.js input validation
A vulnerability was found in a2ui up to 0.10.4. This vulnerability affects unknown code of the file src/v0_9/basic_catalog/components/Image.js of the component Image Player/Video Player/Audio Player. Performing a manipulation of the argument url results in im…
-
Medium 6.2
Blombooru: administrator image-proxy server-side request forgery
Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET /proxy-image` endpoint, exposed as `/api/booru-import/proxy-image`, accepts a `url` query parameter and fetches it ser…
-
Medium 6.5
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse…
-
Medium 5.5
gopass before 1.17.0 Path Traversal via fs Storage Prune and IsDir
gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synce…
-
Medium 5.3
Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php
Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via th…
-
Medium 4.7
CherryTree through 1.7.2 Local File Disclosure via Embedded-File Filename Path
CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or…
-
Medium 4.3
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an af…
-
Medium 6.0
GraphQL Tools: Shared legacy executor routes one subscription's results to a different caller
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and …
-
Medium 5.3
@hono/node-server: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths
@hono/node-server allows running the Hono application on Node.js. From 1.19.10 until 2.1.3, serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evalu…
-
Medium 6.9
Vite: `server.fs.deny` bypassed with queries
Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is expo…
-
Medium 6.5
Happy DOM: Cookie scope forgery: no DNS-label boundary on Domain= matching , attacker origin sets victim cookies
Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 20.14.6, Happy DOM's CookieContainer in src/cookie/CookieContainer.ts does not correctly validate or match Domain cookie attributes. It can accept a Domai…
-
Medium 4.7
Echo: Arbitrary Scheme Injection in WWWRedirect/NonWWWRedirect Middlewares via X-Forwarded-Proto
Echo is a Go web framework. Prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to constru…
-
Medium 5.9
Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the reque…
-
Medium 6.1
Echo: Open Redirect via Control-Character Prefix Defeating sanitizeURI
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a r…
-
Medium 5.9
Echo: Static Middleware Double-Unescape Path Traversal
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can consequently be reconstructed before filesystem resolution. This can reach a file under a guar…
-
Medium 5.9
Echo static file middleware route protection bypass via encoded dot-dot traversal
Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware.…
-
Medium —
MySqlConnector: Account password disclosed to a man-in-the-middle in zero-configuration TLS mode (clear-text password sent before certificate is verified)
## Summary With `SslMode` set to `VerifyCA` or `VerifyFull` with no configured CA certificate, an unvalidated TLS connection is treated as secure and a clear-text password can be sent before the certificate is checked. This can occur when relying on the passw…
-
Medium 4.7
Ember: Unneutralised terminal escape/control sequences from Caddy logs injected into the operator's TUI
Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support. Prior to 1.4.2, interactive TUI row formatters pass Caddy access-log fields, particularly the request URI, through the `fitCellLeft` render helper without neutralizing terminal…
-
Medium 4.7
Endatix: Blind second-order SSRF via anonymous form-submission file URLs (`SubmissionFileExtractor`)
Endatix is a self-hosted form and survey management platform with a headless API. Prior to 0.7.0, the anonymous `POST /forms/{formId}/submissions` endpoint stores attacker-controlled `JsonData` after checking only that the JSON is well formed. A file object w…
-
Medium 5.3
Echo: Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration
Echo is a Go web framework. From 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP values when Echo.IPExtractor is unset, and the default RateLimiter uses that result as its client identifier. A remote attacker can r…