38,614 results · Feed
-
Medium 5.5
LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint
### Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. ### Details In `internal/plugin/native…
-
Medium 5.5
LF Edge eKuiper: SSRF in External Service
### Summary Server-side request forgery (SSRF) vulnerability in eKuiper allows an attacker with permissions to register external services or create rules to induce the eKuiper server to make requests to unintended network locations, such as internal services,…
-
Low 3.7
LF Edge eKuiper: Self-XSS in External Service Creation
### Summary A Cross-Site Scripting (XSS) vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfac…
-
Medium 4.3
Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153
Missing Authorization vulnerability in Drupal Ultimate Table Field allows Forceful Browsing. This issue affects Ultimate Table Field versions: from 0.0.0 to 1.1.1, from 2.0.0 to 2.0.1.
-
Medium 4.3
Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152
Missing Authorization vulnerability in Drupal Taxonomy Term Glossary allows Forceful Browsing. This issue affects Taxonomy Term Glossary versions: from 0.0.0 to 4.6.0.
-
Low 3.3
SAML SSO - Service Provider - Moderately critical - Server Side Request Forgery - SA-CONTRIB-2026-151
Server-Side Request Forgery (SSRF) vulnerability in Drupal SAML SSO - Service Provider allows Server Side Request Forgery. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Low 3.1
SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150
Authentication Bypass by Capture-replay vulnerability in Drupal SAML SSO - Service Provider allows Remote Services with Stolen Credentials. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Low 3.8
SAML SSO - Service Provider - Moderately critical - Information disclosure - SA-CONTRIB-2026-149
Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Medium 5.3
SAML SSO - Service Provider - Moderately critical - Embedded credentials - SA-CONTRIB-2026-148
Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Low 3.3
SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Low 3.5
SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Medium 4.8
SAML SSO - Service Provider - Moderately critical - Authentication bypass - SA-CONTRIB-2026-145
Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature Spoof. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Medium 4.8
SAML SSO - Service Provider - Critical - Weak cryptographic practices - SA-CONTRIB-2026-144
Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Medium 5.4
SAML SSO - Service Provider - Critical - Open redirect - SA-CONTRIB-2026-143
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Medium 4.8
SAML SSO - Service Provider - Critical - Improper certificate validation - SA-CONTRIB-2026-142
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Medium 6.5
SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141
Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
-
Medium 4.6
SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. This issue affects SafeDelete versions: from 0.0.0 to 1.0.88.
-
Medium 5.4
Key auth - Moderately critical - Access bypass - SA-CONTRIB-2026-138
Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Key auth versions: from 0.0.0 to 2.2.4.
-
Medium 4.2
Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. This issue affects Feed Block versions: from 0.0.0 to 2.0.2, from 3.0.0 to 3.0.2.
-
Medium 6.5
CSP log - Critical - SQL Injection - SA-CONTRIB-2026-136
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log allows SQL Injection. This issue affects CSP log versions: from 0.0.0 to 1.0.2.
-
Medium 6.5
Central Authentication System (CAS) Server - Moderately critical - Open redirect - SA-CONTRIB-2026-135
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2…
-
Medium 6.5
amazee.ai Private AI Provider - Critical - SQL injection - SA-CONTRIB-2026-134
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai Private AI Provider allows SQL Injection. This issue affects amazee.ai Private AI Provider versions: from 0.0.0 to 1.3.7, from 1.4.0 to 1.4.…
-
Medium 6.8
gix-sec safe.directory protections absent for elevated administrators
gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program with an unfiltered elevated token. In gix-…
-
Medium 5.9
ASP.NET Core Denial of Service Vulnerability
Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network.
-
High 8.8
.NET and Visual Studio Remote Code Execution Vulnerability
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
-
High 8.8
.NET and Visual Studio Elevation of Privilege Vulnerability
Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
.NET and Visual Studio Remote Code Execution Vulnerability
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
-
Unscored —
`unzip`: archive extraction is vulnerable to path traversal (zip-slip)
### Summary `Unzipper::unzip` extracts each archive entry to a path built from the entry's **raw, attacker-controlled name** without any traversal check. A ZIP archive whose entry names contain `../` components (or an absolute path) can therefore cause files …
-
Unscored —
Double free in `OwnedAlloc::drop_in_place` when the contained value's `Drop` panics
`OwnedAlloc::drop_in_place` destroys the contained value by hand, then commits the ownership transfer with `mem::forget(self)` — which lives inside `into_raw` and so runs only after the destruction. `T::drop` is user code and may panic. If it does, the forget…
-
Unscored —
Double free in `AlignedBox<[T]>::realloc_with_default` when an element's `Drop` panics
Shrinking an `AlignedBox<[T]>` takes ownership of the buffer out of `self.container` with `ManuallyDrop::take`, destroys the elements past the new length, and only then commits the new `Box` back into `self.container`. `ManuallyDrop::take` moves ownership but…
-
Medium 5.3
n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to buil…
-
Medium 6.5
Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass
Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible …
-
High 7.5
Nodemailer before 9.1.0 Denial of Service via addressparser
Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a lar…
-
Medium 6.5
Nodemailer before 9.1.0 Email Domain Validation Bypass via RFC 5322 Comment
Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment instead of treating…
-
High 7.1
OpenAPI3 version value escapes `emitterOutputDir` and overwrites YAML/JSON outside the output tree
### Summary The `@typespec/openapi3` emitter retains the value of a `@versioned` enum member and interpolates it into the output filename as `{version}` without sanitizing path separators or traversal components. The completed path reaches the compiler's `emi…
-
High 7.5CVE-2026-77078 Public exploit
multer vulnerable to Denial of Service via crafted multipart field names
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request containing two specially crafted text field names can cause an uncaught RangeError (Invalid array length) that terminates the Node.js process. The first field uses a…
-
High 7.5
multer vulnerable to Denial of Service via file descriptor leak on aborted uploads
multer is a middleware for handling multipart/form-data in Node.js. In version 2.2.0, when a disk-backed upload is aborted or truncated before the write stream finishes, multer's disk storage engine removes the visible file but does not close the underlying w…
-
Low 3.7
multer vulnerable to file size limit bypass via async fileFilter race condition
multer is a middleware for handling multipart/form-data in Node.js. When an application uses an asynchronous fileFilter together with the fileSize limit, a race condition in multer's file stream handling can allow a file that exceeds the configured size limit…
-
High 7.5
multer vulnerable to Denial of Service via oversized array index in field names
multer is a middleware for handling multipart/form-data in Node.js. A small multipart request with two specially crafted text field names can make multer's field parser synchronously iterate a maximum-length sparse array, blocking the event loop so the proces…
-
Medium 5.3
morgan vulnerable to Log Forging via unescaped Unicode line separators
morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode line separator characters U+0085 (Next Line), U+2028 (Line Separator), and U+2029 (Paragraph…