38,658 results · Feed
-
High 8.8
Apache Airflow: Unguarded import_string() of airflow_exc_ser / base_exc_ser exception nodes in BaseSerialization.deserialize enables DAG-author RCE on Scheduler / API Server
Apache Airflow's serialization layer reconstructed exception nodes by calling `import_string()` on a class name taken from the serialized blob and instantiating it with arguments from the same blob, with no restriction on what could be imported. An operator's…
-
Medium 5.3
Quick Tabs - Moderately critical - Access bypass - SA-CONTRIB-2026-099
Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4.3.1.
-
Medium 5.4
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.
-
Medium 5.3
Entity Share Websub - Moderately critical - Server-side request forgery (SSRF) - SA-CONTRIB-2026-097
Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects Entity Share Websub versions: from 0.0.0 to 1.1.2.
-
Medium 5.3
Diff - Moderately critical - Access bypass - SA-CONTRIB-2026-096
Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
-
Critical 9.1
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from 0.0.0 to 1.12.0, from 2.0.0 to 2.1.3.
-
High 8.6
Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
Compliance-trestle (Trestle) is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypass…
-
High 7.1
SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames
SSH.NET is a Secure Shell (SSH) library for .NET. In 2025.1.0 and earlier, ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directo…
-
Medium 6.5
Fleet: Observer-class users can view team enroll secrets and credential-bearing configuration via target search endpoint
Fleet is an open-source device management platform built on osquery. In versions prior to 4.87.0, the target search endpoint (POST /api/latest/fleet/targets) returned unmasked team enroll secrets and full team configuration, including credential-bearing agent…
-
Medium 5.4
phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration
phpMyFAQ is an open source FAQ web application. Prior to version 4.2.0-alpha, an authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logged-in user to bypass the intended display-name search filter and enumerate a…
-
High 7.5
Nimiq: Validity store off by one error
Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Through 1.5.0, the validity store uses a strict lower-bound comparison that expires a stored transaction too early relative to Transaction::is_vali…
-
Medium 5.4
LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters
LibreNMS is a network monitoring system. In versions up to and including 26.4.0, the Proxmox application view is vulnerable to reflected cross-site scripting through the user-supplied instance and vmid GET parameters, which are reflected into the page title w…
-
High 7.1
Winter: Authenticated backend users can bypass Users controller permission checks
Winter CMS is a content management system built on the Laravel PHP framework. In versions prior to 1.2.13, the backend did not validate the handler name submitted through the form postback _handler POST field, allowing an authenticated backend user to invoke …
-
Medium 6.8
Winter: Broken access control in `Cms\Controllers\Index` allows cross-template actions and unauthorized asset uploads
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the CMS section's Theme Editor AJAX handlers did not enforce per-template-type permission checks, allowing a backend user with any single CMS…
-
Medium 5.9
Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax
Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend Filter widget is vulnerable to SQL injection through the numberrange scope type when that scope is configured with a conditions k…
-
High 8.1
Winter: Stored XSS through Editor Settings custom styles
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. From 1.2.10 through 1.2.12, authenticated backend users with the backend.manage_editor permission can store custom Markup Styles that are compiled by the LESS pa…
-
High 8.1
Winter: Stored XSS through Brand Settings custom styles
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Prior to 1.2.13, custom CSS supplied through the Brand Settings Styles field by a backend user with the backend.manage_branding permission is compiled by the LES…
-
Unscored —
Memory corruption bug on `ApplyResult` type
The `ApplyResult` type contains a raw pointer to a C++ memory object and has a derived `Clone` implementation which creates a reference to this object without incrementing the associated reference counter. As a result, if an instance of `ApplyResult` is dupli…
-
Medium 6.5
Apache Airflow Google provider: google Secret Manager backend: team scope is never applied, exposing every team's Connections and Variables
The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every…
-
Medium 5.4
tablib versions prior to 3.10.0 Stored XSS via HTML Export Dataset Title
tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML …
-
Medium 6.5
.NET Information Disclosure Vulnerability
Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to disclose information over a network.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
-
High 7.0
.NET Framework Remote Code Execution Vulnerability
Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to execute code locally.
-
High 7.8
.NET Core Remote Code Execution Vulnerability
Out-of-bounds write in .NET allows an unauthorized attacker to execute code locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Uncaught exception in .NET allows an authorized attacker to elevate privileges locally.
-
High 7.8
.NET Elevation of Privilege Vulnerability
Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
-
High 7.5
.NET Denial of Service Vulnerability
Unchecked input for loop condition in .NET allows an unauthorized attacker to deny service over a network.
-
Medium 5.9
.NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in .NET allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.5
Microsoft QUIC Information Disclosure Vulnerability
Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
-
Critical 9.3
SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle
SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle…
-
Unscored —
`sp-sized-chunks` is unmaintained
The `sp-sized-chunks` crate is a fork of `sized-chunks`. Its repository is archived and the crate is no longer maintained. Users should migrate to [`imbl-sized-chunks`](https://crates.io/crates/imbl-sized-chunks), a maintained fork.
-
Unscored —
Panic-safety unsoundness in `truncate_back`, `truncate_front`, `clear`, and `extend_from_slice` (use-after-free / double-free)
Several methods in `circular-buffer` drop elements before updating the buffer's start/end metadata. If an element's `Drop` panics during the drop, the metadata update is skipped, so the buffer still treats the already-dropped elements as live. When the buffer…
-
Unscored —
Panic-safety unsoundness in `Chunk`, `RingBuffer`, and `InlineArray` (use-after-free / double-free)
Several methods in `sized-chunks` drop elements before updating the length/boundary metadata. If an element's `Drop` panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. When the container…
-
Unscored —
Panic-safety unsoundness in `Chunk` and `InlineArray` (use-after-free / double-free)
Several methods in `sp-sized-chunks` drop elements before updating the container's length/boundary metadata. If an element's `Drop` panics during the drop, the metadata update is skipped, so the container still treats the already-dropped elements as live. Whe…
-
Unscored —
Panic-safety unsoundness in `SplitVec::extend_from_slice` (uninitialized read)
`SplitVec::extend_from_slice` increments the logical length `self.len` before cloning the incoming elements into the reserved slots. If an element's `Clone` panics mid-fill, unwinding leaves `self.len` counting slots that were never initialized. A later safe …
-
Medium 4.6
`enter_l2_vcpu` passes the wrong RCX operand to `TDG.VP.ENTER`
Incorrect calculation for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation…
-
Medium 4.6
Inverted bitmap validation in `invalidate_l2_cached_ept`
Incorrect comparison for some Intel(R) TDX Guest software before version 0.3.1 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation …
-
High 7.0
Multiple vulnerabilities in SAP Business AI Platform (Approuter)
SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The att…
-
Critical 9.9
Feast: feast: unsafe dill deserialization of registry-stored udfs — rce on feature server and registry server
A flaw was found in Feast. The system improperly deserializes user-defined functions (UDFs) stored in its registry, which are serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary cod…
-
High 7.1
Hugging Face Accelerate 1.14.0 Path Traversal and DoS via weight_map
Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths…