WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕Protection: None✕
Overview 17,867 matches · 805 in Waratek scope · 0 protected · 47 exploited · 5 CISA KEV · 648 public PoC · 23 EPSS ≥ 0.5
17,867matches 805in Waratek scope4.5% 0protected0.0% 47exploited0.3% 5CISA KEV0.0% 648public PoC3.6% 23EPSS ≥ 0.50.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 17 0.1% No exploit published 788 4.4% Outside Waratek scope 218 1.2% Not applicable 16,844 94.3% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 0 0.0% Low 17,867 100.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 17,867 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 47 0.3% Working exploit published 619 3.5% Proof of concept only 5,475 30.6% Forecast only 7 0.0% No public exploit 11,719 65.6%
split by peak 6,470 / year
Not applicable: 16,844Outside Waratek scope: 218No exploit published: 788Mitigation candidate: 17 Low: 17,867 not blocked: 17,867 No public exploit: 11,719Forecast only: 7Proof of concept only: 5,475Working exploit published: 619Exploited: 47
19901 Not applicable1 Low1 not blocked1 No public exploit1 19910 19921 Not applicable1 Low1 not blocked1 No public exploit1 19932 Not applicable2 Low2 not blocked2 No public exploit2 19941 Not applicable1 Low1 not blocked1 Working exploit published1 19951 Not applicable1 Low1 not blocked1 No public exploit1 19969 Not applicable9 Low9 not blocked9 No public exploit9 199719 Not applicable19 Low19 not blocked19 Working exploit published4 Forecast only2 No public exploit13 199823 Not applicable23 Low23 not blocked23 Working exploit published5 No public exploit18 1999111 Not applicable111 Low111 not blocked111 Working exploit published28 No public exploit83 200096 Not applicable96 Low96 not blocked96 Working exploit published34 No public exploit62 2001182 Outside Waratek scope2 Not applicable180 Low182 not blocked182 Working exploit published38 No public exploit144 2002143 No exploit published3 Not applicable140 Low143 not blocked143 Working exploit published18 Forecast only2 No public exploit123 200397 Mitigation candidate1 No exploit published5 Outside Waratek scope1 Not applicable90 Low97 not blocked97 Working exploit published16 No public exploit81 2004203 No exploit published3 Not applicable200 Low203 not blocked203 Working exploit published36 No public exploit167 2005441 No exploit published5 Outside Waratek scope1 Not applicable435 Low441 not blocked441 Exploited2 Working exploit published52 No public exploit387 2006509 No exploit published11 Outside Waratek scope1 Not applicable497 Low509 not blocked509 Exploited1 Working exploit published99 No public exploit409 2007231 No exploit published10 Outside Waratek scope4 Not applicable217 Low231 not blocked231 Working exploit published28 Proof of concept only1 No public exploit202 2008185 No exploit published7 Outside Waratek scope3 Not applicable175 Low185 not blocked185 Working exploit published30 No public exploit155 2009196 No exploit published21 Outside Waratek scope5 Not applicable170 Low196 not blocked196 Exploited1 Working exploit published32 No public exploit163 2010277 Mitigation candidate2 No exploit published20 Outside Waratek scope10 Not applicable245 Low277 not blocked277 Exploited1 Working exploit published28 No public exploit248 2011259 Mitigation candidate2 No exploit published31 Outside Waratek scope13 Not applicable213 Low259 not blocked259 Working exploit published13 Proof of concept only1 No public exploit245 2012508 Mitigation candidate4 No exploit published76 Outside Waratek scope6 Not applicable422 Low508 not blocked508 Working exploit published33 Proof of concept only1 No public exploit474 2013514 Mitigation candidate2 No exploit published51 Outside Waratek scope11 Not applicable450 Low514 not blocked514 Exploited4 Working exploit published20 No public exploit490 2014656 No exploit published49 Outside Waratek scope14 Not applicable593 Low656 not blocked656 Exploited1 Working exploit published27 Proof of concept only1 No public exploit627 2015587 Mitigation candidate4 No exploit published46 Outside Waratek scope12 Not applicable525 Low587 not blocked587 Working exploit published33 Proof of concept only1 Forecast only1 No public exploit552 2016221 No exploit published33 Outside Waratek scope10 Not applicable178 Low221 not blocked221 Working exploit published4 Forecast only2 No public exploit215 2017231 No exploit published22 Outside Waratek scope9 Not applicable200 Low231 not blocked231 Exploited2 Working exploit published2 Proof of concept only1 No public exploit226 2018156 No exploit published10 Outside Waratek scope12 Not applicable134 Low156 not blocked156 Working exploit published6 Proof of concept only2 No public exploit148 2019293 No exploit published20 Outside Waratek scope19 Not applicable254 Low293 not blocked293 Proof of concept only1 No public exploit292 2020388 No exploit published27 Outside Waratek scope24 Not applicable337 Low388 not blocked388 Working exploit published2 Proof of concept only2 No public exploit384 2021389 No exploit published14 Outside Waratek scope13 Not applicable362 Low389 not blocked389 Proof of concept only5 No public exploit384 2022379 No exploit published13 Outside Waratek scope7 Not applicable359 Low379 not blocked379 Working exploit published2 Proof of concept only15 No public exploit362 2023317 No exploit published11 Outside Waratek scope10 Not applicable296 Low317 not blocked317 Exploited2 Working exploit published2 Proof of concept only38 No public exploit275 2024736 Mitigation candidate1 No exploit published23 Outside Waratek scope10 Not applicable702 Low736 not blocked736 Exploited1 Working exploit published2 Proof of concept only110 No public exploit623 20253,035 No exploit published36 Outside Waratek scope5 Not applicable2,994 Low3,035 not blocked3,035 Exploited23 Working exploit published14 Proof of concept only1,975 No public exploit1,023 20266,470 Mitigation candidate1 No exploit published241 Outside Waratek scope16 Not applicable6,212 Low6,470 not blocked6,470 Exploited9 Working exploit published10 Proof of concept only3,321 No public exploit3,130
1990199319961999200220052008201120142017202020232026
17,867 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 179 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-97683 Low 2026-11-13 Not applicable No public exploit IBM Cyber Fraud 1.0.0 through 1.1.0 could allow a local attacker to bypass security restrictions due to a missing or misconfigured security context.
CVE-2026-93333 Low 2026-11-13 Not applicable No public exploit Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.
CVE-2026-82175 Low 2026-11-13 Not applicable No public exploit Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance.
CVE-2026-59080 Low 2026-11-13 Not applicable No public exploit Edito CMS sends JWT token via GET requests. This allows a local attacker with access to browser history to obtain valid JWT token and perform action on behalf of the victim. The token is valid for only short period of time; after that time, it expires and can no longer be used. The vendor assessed the likelihood of exploitation as very low and determined that a fix is not necessary.
CVE-2026-5514 Low 2026-11-13 Not applicable No public exploit IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.
CVE-2026-16671 Low 2026-11-13 Not applicable No public exploit split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the out_hash out-parameter to bootutil_img_validate(). That routine copies IMAGE_HASH_SIZE bytes into out_hash (memcpy(out_hash, hash, IMAGE_HASH_SIZE) in boot/bootutil/src/image_validate.c), where IMAGE_HASH_SIZE is a compile-time constant of 64 for MCUBOOT_SHA512 or 48 for MCUBOOT_SIGN_EC384/SHA-384 (boot/bootutil/include/bootutil/crypto/sha.h). The buffer tracks SHA-256 (32 bytes) while the copy length tracks the configured algorithm, so the write overruns the buffer by 16 or 32 bytes. The overflow is only present in a non-default configuration: the legacy Mynewt split-image feature must be compiled (split_go()/split_image_check(), i.e. neither MCUBOOT_DIRECT_XIP nor MCUBOOT_RAM_LOAD), the digest must be larger than 32 bytes (MCUBOOT_SHA512 or MCUBOOT_SIGN_EC384), and MCUBOOT_SIGN_PURE must be off. split_go() is a public API with no caller inside MCUboot; it is invoked from a Mynewt application. In the default SHA-256 build there is no overflow. The over-written bytes are the one-way digest of the loader image and the overflow length is fixed at build time, so the contents are not meaningfully attacker-controlled and the size is not attacker-chosen. The realistic impact is bounded, uncontrolled corruption of the bootloader's stack on the split-boot path, manifesting as instability or failed boot in the affected configuration rather than reliable code execution. The fix is to size loader_hash to IMAGE_HASH_SIZE and pass IMAGE_HASH_SIZE as the matching seed length.
CVE-2026-16662 Low 2026-11-13 Not applicable No public exploit boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer image_hash[IMAGE_HASH_SIZE] that is never zero-initialised. The TLV handler validates only the upper bound (len > sizeof(image_hash)) and then reads exactly len bytes, so a TLV shorter than IMAGE_HASH_SIZE leaves the tail of image_hash holding stale stack content. The subsequent copy into the boot record, memcpy(buf + offset, image_hash, sizeof(image_hash)), uses the fixed buffer size rather than len, so up to IMAGE_HASH_SIZE - 1 bytes of uninitialised bootloader stack are written into the measured-boot record. The defect is reachable only under MCUBOOT_MEASURED_BOOT, and only when nothing has checked the length of the hash TLV before boot_save_boot_status() reads it. bootutil_img_validate() rejects a hash TLV whose length is not exactly sizeof(hash) (boot/bootutil/src/image_validate.c:345), and primary-slot validation is on by default (Zephyr's CONFIG_BOOT_VALIDATE_SLOT0 defaults to y), so in a default build the malformed image never reaches this code. Two kinds of build let a short TLV through: Builds that use pure signatures (MCUBOOT_SIGN_PURE, Zephyr CONFIG_BOOT_SIGNATURE_TYPE_PURE). The signature covers the image itself, so the hash-TLV check in bootutil_img_validate() is compiled out, and a pure-signed image normally carries no hash TLV. A hash TLV is still allowed in the unprotected TLV area, which the signature does not cover, so a short one can be added to a correctly signed image without invalidating it. This applies with every upgrade strategy, including direct-XIP and RAM-load, and the modified image can be delivered through any path that accepts a signed image. Builds with primary-slot validation turned off: the swap and overwrite loader built without MCUBOOT_VALIDATE_PRIMARY_SLOT, which checks only the image magic before calling boot_add_shared_data(), and the Zephyr single-slot loader (boot/zephyr/single_loader.c) built without it, including the MCUBOOT_VALIDATE_PRIMARY_SLOT_ONCE variant, which skips validation once the trailer records an earlier successful one. Placing the crafted image requires physical or flash-write access to the device; in a single-slot build with serial recovery enabled, the serial-recovery upload writes the primary slot directly and can place it as well. Outside pure-signature builds, the direct-XIP and RAM-load strategies in boot/bootutil/src/loader.c validate the selected slot unconditionally and are not affected. It is also reachable through a time-of-check/time-of-use change to tamperable external flash between validation and the boot-record read. In these configurations the boot record's measurement is already not trustworthy: the hash copied into the record is the image's own EXPECTED_HASH_TLV, which nothing has verified and which the attacker chooses. The defect therefore does not weaken attestation integrity any further. What it adds is a path for bootloader memory to leave the device: up to 63 bytes (IMAGE_HASH_SIZE - 1) of uninitialised bootloader stack are embedded in the measurement field that a downstream attestation service sends to a remote verifier. In the configurations analysed the residue is bootloader internal state (TLV offsets and lengths, flash addresses, loop state), not key material, but what occupies that stack region depends on configuration and on which code ran before boot_save_boot_status(). It is reported as a low-severity, defense-in-depth disclosure with no integrity or availability impact. This is distinct from the already-fixed record_len integer underflow in the same routine (GHSA-8hrv-4cp5-4rg3). The fix rejects any EXPECTED_HASH_TLV whose length is not exactly IMAGE_HASH_SIZE.
CVE-2026-129132 Low 2026-11-13 Not applicable No public exploit MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates unescaped login usernames into DN search and group-membership filters. Attackers with valid directory credentials outside the required group can submit crafted usernames that make the group filter always true, bypassing access restrictions.
CVE-2026-129094 Low 2026-11-13 Not applicable No public exploit @utcp/http before 1.1.14 contains a server-side request forgery vulnerability that allows remote manuals to reach loopback services by bypassing the remote-loopback check with a {host} placeholder. Attackers can supply host arguments like 127.0.0.1 or register tools via Streamable HTTP and SSE discovery to access internal services on the agent machine.
CVE-2026-128348 Low 2026-11-13 Not applicable Proof of concept only ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js that fails to escape [, ], # and ' characters in structured reference column names. Attackers can supply column names containing ] via untrusted input like imported CSV headers to inject formulas such as HYPERLINK that exfiltrate cell values when users open and click the generated workbook.
CVE-2026-128335 Low 2026-11-13 Not applicable No public exploit Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user sessions when two-factor authentication is enabled or disabled. Because Contao\User::isEqualTo() and serialized session data omit two-factor state, attackers already holding a session keep it after the owner changes 2FA settings.
CVE-2026-128330 Low 2026-11-13 Not applicable No public exploit Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access because password changes do not revoke existing web sessions. Attackers holding a leaked password or copied session cookie keep access for up to 30 days, reading integration credentials, creating API keys, or registering passkeys.
CVE-2026-128091 Low 2026-11-13 Not applicable No public exploit When MCUboot is built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT), bootutil_aes_ctr_drop() in boot/bootutil/include/bootutil/crypto/aes_ctr_tinycrypt.h was an empty stub. The AES-CTR context for this backend is the fully expanded AES-128 key schedule (struct tc_aes_key_sched_struct). Generic code relies on this hook to release and clear key state, so with TinyCrypt nothing was cleared. The mbedTLS and PSA backends do free or destroy their key state here. As a result, boot_state_clear(), which boot_go() calls before handing off to the application, left the image's AES content-encryption key schedule in the static boot_data state. This is the case after an encrypted upgrade in single-image builds, where boot_enc_zeroize() is not called. boot_decrypt_key() likewise left the ECIES-derived key-encryption key schedule on the stack. The affected build uses MCUBOOT_ENC_IMAGES with TinyCrypt, which is the default ECDSA and Ed25519 backend in the Zephyr port. The first AES-128 round key equals the cipher key, so anyone who can read the leftover bootloader RAM after boot can recover the image content key and decrypt that encrypted image. That includes a physical attacker with debug or RAM access, or code later running on the device. This weakens image-encryption key confidentiality (and so the confidentiality of the encrypted image's plaintext). The device's long-term private decryption key is not exposed, and image authenticity is not affected. The fix wipes the context with bootutil_wipe_memory().
CVE-2026-128088 Low 2026-11-13 Not applicable No public exploit russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, try_sign() captures an Arc<PrivateKey> before awaiting Agent::confirm() and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in the remediation for CVE-2026-116794. A peer, including a remote SSH server using agent forwarding, can begin a confirmation-constrained signature request while the agent is unlocked and receive the signature after another connection locks the agent if the stale confirmation returns true. New post-lock requests are rejected and private key material is not disclosed, but the pending operation bypasses the current lock state. This issue is fixed in version 0.65.1.
CVE-2026-128087 Low 2026-11-13 Not applicable Proof of concept only russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kex_done() with the raw shared secret before check_server_key() accepts the server host key or certificate. A malicious SSH server can therefore trigger application-defined secondary-channel initialization or early data handling even when the server identity is subsequently rejected. Ordinary clients that keep the callback's no-op default or independently defer callback-derived actions until trust is confirmed are not affected. This issue is fixed in version 0.65.1.
CVE-2026-128083 Low 2026-11-13 Not applicable No public exploit Laravel is a web application framework. Prior to 12.71.0 and 13.40.0, Laravel's Concurrency::run process driver can treat a forged internal result message in child standard output as framework output. An application route must invoke Concurrency::run, and a task must write attacker-controlled bytes at the start of the child's standard output that form a complete JSON document followed by gzip magic bytes. Under those application-specific conditions, an attacker can forge the internal result message and achieve remote code execution. The affected behavior is not exposed by default and requires application code that routes untrusted input into task output. This issue is fixed in versions 12.71.0 and 13.40.0.
CVE-2026-128076 Low 2026-11-13 Not applicable No public exploit Nuxt is an open-source web development framework for Vue.js. From 3.21.6 to before 4.0.0 and from 4.4.6 until 4.6.4, the /__nuxt_island path hash uses ohash serialization that does not escape quotes in string values or delimiters in object keys, allowing different island-prop tuples to produce the same path. For prerendering, substituted content is written into the generated page only if the crawler reaches a colliding URL before rendering the page with the legitimate props. Separately, a CDN or reverse proxy that keys island responses by path alone can be primed with the colliding response. If the substituted prop reaches v-html, innerHTML, or another unsafe HTML sink, the response can execute script in the application origin; otherwise the impact is content substitution. Applications that do not use server components or NuxtIsland, islands without attacker-influenced string props, and responses not cached by path alone are unaffected. This issue is fixed in version 4.6.4.
CVE-2026-128072 Low 2026-11-13 Not applicable No public exploit Nuxt is an open-source web development framework for Vue.js. From @nuxt/webpack-builder 3.0.0 and @nuxt/rspack-builder 3.12.2 until 4.6.4, the development middleware trusts Origin, Referer, or Sec-Fetch-Site when the Host header names the same attacker-controlled hostname. After DNS rebinding changes that hostname to a loopback address, a malicious page opened by a developer can read /_nuxt/*.js client chunks and inline source maps, exposing compiled application source, local filesystem paths, and developer-controlled values embedded in the client bundle. The attacker must know or guess the development-server port and induce the developer to open the malicious page; Chrome 142 and later and other Chromium-based browsers that enforce Local Network Access restrictions prompt before a public page can reach the loopback address. The default Vite builder and production builds are unaffected. This issue is fixed in version 4.6.4.
CVE-2026-128053 Low 2026-11-13 Not applicable No public exploit OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT_NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT_NAME from the request path, executing script in the storefront origin within victims' browsers.
CVE-2026-128043 Low 2026-11-13 Not applicable No public exploit OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a cross-site GET to paypal/standard/cancel to cancel their recent uninvoiced order, void pending authorizations, and restore items to the cart.
CVE-2026-128036 Low 2026-11-13 Not applicable No public exploit In gittuf 0.4.0 through 0.16.0, when a policy update appears within the range of reference state log entries being verified, verification checks only the root of trust signatures of the new policy and not the signatures of its other metadata (rule files). A user trusted to push to the repository who bypasses gittuf policy apply and writes the policy reference and reference state log directly can make an invalid policy apply during verification, weakening or strengthening the rules for later changes. The update is still recorded in the reference state log.
CVE-2026-128029 Low 2026-11-13 Not applicable No public exploit OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in the Dataflow profile run page, which inserts catalog product import row errors into the page without escaping. Unauthenticated attackers can place markup in the store, type, or attribute_set columns of an import file to run script in the session of the administrator who imports it.
CVE-2026-128028 Low 2026-11-13 Not applicable No public exploit OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage_Catalog_Model_Product_Option_Type_File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom_options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.
CVE-2026-127928 Low 2026-11-13 Not applicable No public exploit In MCUboot's serial-recovery encrypted-image support (boot/boot_serial/src/boot_serial_encryption.c), decrypt_image_inplace() and boot_image_validate_encrypted() each keep a stack-local struct boot_status. boot_enc_load() writes the plaintext per-image AES key into its enckey[] field. Neither function cleared this structure before returning. In addition, a decrypt failure inside the per-sector loop of decrypt_image_inplace() returned early and skipped the total_out: cleanup, which left the expanded AES key context (enc_data) on the stack as well. The error paths of boot_image_validate_encrypted() similarly skipped boot_enc_zeroize(). The affected code is built when encrypted images (MCUBOOT_ENC_IMAGES, Zephyr CONFIG_BOOT_ENCRYPT_IMAGE) are combined with serial recovery. It runs when an encrypted image is uploaded to the primary slot over the recovery protocol, and when the image list or state is queried while an encrypted image is in the secondary slot. After these functions return, the image's AES content key remains in dead stack memory. An attacker who can later read device RAM, for example through a debug port or retained RAM, can recover it. This weakens the confidentiality of image-encryption keys within the bootloader trust boundary. A recovered key exposes the plaintext of the encrypted firmware image it protects. The device's long-term private decryption key is not exposed. No remote or recovery-protocol channel that returns this memory is known, so exploitation requires a separate memory-read capability.
CVE-2026-127916 Low 2026-11-13 Not applicable No public exploit bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check. Nothing earlier on the validation path bounds the whole span either: bootutil_img_validate() compares the image size against bootutil_max_image_size() only after the hash has been computed. The callers bound part of the span, or none of it: On the swap and overwrite upgrade path, boot_validate_slot() first runs the image header check (boot_is_header_valid(), later boot_check_header_valid()). Before MCUboot 2.2.0 that check covered only ih_hdr_size + ih_img_size, so for every image the protected-TLV area (ih_protect_tlv_size, a uint16_t, up to 65535 bytes) was hashed without being bounded. From 2.2.0 the check includes ih_protect_tlv_size, except for a compressed image in the secondary slot when MCUBOOT_DECOMPRESS_IMAGES (CONFIG_BOOT_DECOMPRESSION) is enabled, which leaves the same gap of up to 64 KB. Zephyr's single-slot and firmware loaders (boot/zephyr/single_loader.c, boot/zephyr/firmware_loader.c) read the header with boot_image_load_header(), which bounds ih_hdr_size + ih_img_size against the flash area. Before MCUboot 2.4.0 that bound did not include ih_protect_tlv_size, which leaves the same gap of up to 64 KB. From 2.4.0 these loaders bound the whole span. The serial recovery image-list and image-state handlers (bs_list() and bs_set() in boot/boot_serial/src/boot_serial.c) call bootutil_img_validate() with no header check at all, so on those paths ih_img_size is unbounded as well. The image is hashed before its signature is checked, so anyone who can place an image in a slot (an OTA or SMP update delivered through the application, or serial recovery) reaches this read before authentication. Whether a malformed header produces an actual read beyond the area depends on the flash backend: Backends whose flash_area_read() bounds-checks the request (Zephyr, Espressif, NuttX, Mbed) return an error once the chunked read crosses the end of the area. Validation fails and the image is rejected, with no over-read. With MCUBOOT_HASH_STORAGE_DIRECTLY (Zephyr CONFIG_BOOT_IMG_HASH_DIRECTLY_ON_STORAGE, available from 2.2.0, not enabled by default) the span is hashed through a single direct pointer into memory-mapped flash, with no bounds check. The Cypress PSoC6 port's flash_area_read() (boot/cypress/cy_flash_pal/cy_flash_map.c, from 1.6.0) does not bound the read: its assert()s compare against the area's absolute offset rather than its size, and it copies with memcpy(). The bytes read past the area feed only the digest, which is compared internally and never returned, so nothing is disclosed. The realistic effect is a read fault during image validation: up to 64 KB past the slot on the upgrade path and, before 2.4.0, on the Zephyr loaders, and potentially much further on the serial recovery handlers, which skip the header check. Where validation is repeated at every boot (a pending upgrade, or, before 2.4.0, the single-slot loader checking its image), the fault can recur on each reset and keep the device from booting. The fix makes bootutil_img_hash() add the three sizes with boot_u32_safe_add() and reject an image whose span, including the sector offset used in swap-using-offset mode, does not fit in the flash area, before any of it is hashed. Because the bound is applied where the bytes are read, it covers every caller.
CVE-2026-127915 Low 2026-11-13 Not applicable No public exploit The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single loop guard (it->tlv_off < it->tlv_end) and advances by sizeof(struct image_tlv) + tlv.it_len using the attacker-controlled it_len field, without validating that the entry's header or payload stays within it->tlv_end. As a result the 4-byte header read can extend up to 3 bytes past the declared TLV area, and the returned (off, len) can describe a payload that runs past it. The path is pre-authentication: TLVs are parsed during bootutil_img_validate() before the signature is verified, and a crafted image can be presented through DFU / serial-recovery / OTA. However the impact is contained by surrounding guards: bootutil_img_validate() first rejects a TLV area larger than bootutil_max_image_size(), the default LOAD_IMAGE_DATA sink is flash_area_read() which bounds-checks against the flash partition and fails an out-of-partition read, and every payload consumer (EXPECTED_HASH_TLV, EXPECTED_KEY_TLV, EXPECTED_SIG_TLV, IMAGE_TLV_SEC_CNT) clamps len against a fixed buffer before copying. The residual effect in a default flash build is therefore an out-of-region read confined to the attacker's own slot partition whose result is never observable, yielding at worst a clean validation failure rather than memory corruption or information disclosure. A genuine (though still bounded) out-of-bounds read remains under the non-default MCUBOOT_RAM_LOAD configuration, where LOAD_IMAGE_DATA is an unchecked memcpy. The fix is to validate each entry's header and payload against it->tlv_end inside the iterator.
CVE-2026-127285 Low 2026-11-13 Not applicable No public exploit A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg_forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-127282 Low 2026-11-13 Not applicable No public exploit A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected by this vulnerability is an unknown functionality of the file reset_password.php. This manipulation of the argument Username causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-127276 Low 2026-11-13 Not applicable Proof of concept only A vulnerability was identified in Linksys EA8100 1.0.3.216940. Impacted is an unknown function of the component Web UI. Such manipulation leads to cookie without 'httponly' flag. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is considered difficult. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-127274 Low 2026-11-13 Not applicable No public exploit A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-127273 Low 2026-11-13 Not applicable No public exploit A vulnerability has been found in Linksys EA8100 1.0.3.216940. This affects the function GetWANStatus/GetWANStatus3/IsAdminPasswordDefault of the component JNAP API. The manipulation leads to missing authentication. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-127087 Low 2026-11-13 Not applicable No public exploit Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to revoke other users' access links by supplying an arbitrary accessLinkId. Attackers can obtain access link ids from public share URLs and revoke them without ownership checks, breaking shared access for all link users.
CVE-2026-126954 Low 2026-11-13 Not applicable No public exploit Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension endpoints to inject javascript: URLs via the Widget-Title-URL response header. Attackers controlling an extension endpoint can execute script when users click the widget title, reading dashboard pages through same-origin requests and exfiltrating content.
CVE-2026-126839 Low 2026-11-13 Not applicable No public exploit A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required.
CVE-2026-126490 Low 2026-11-13 Not applicable No public exploit OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning.
CVE-2026-126409 Low 2026-11-13 Not applicable No public exploit Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion vulnerability because StructType::with_finality_and_supertype does not validate that the supplied supertype belongs to the same Engine. Embedders using multiple engines that create a GC struct type with another engine's supertype can trigger runtime panics or GC heap corruption, causing denial of service; guest WebAssembly cannot trigger it.
CVE-2026-126408 Low 2026-11-13 Not applicable Proof of concept only Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in the TypedFunc embedder API for I31, Option<I31>, and Option<NoneRef> parameter or result types, reaching an unreachable!() path. A malicious guest module exporting a function that uses another anyref-hierarchy type can panic the host embedding, causing denial of service.
CVE-2026-126392 Low 2026-11-13 Not applicable No public exploit Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.
CVE-2026-126363 Low 2026-11-13 Not applicable No public exploit Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Solid component using a client:* directive and dynamic access to the attacker-chosen slot property; a component that did not render that slot emitted only escaped fallback content. This issue is fixed in version 7.1.2.
CVE-2026-126362 Low 2026-11-13 Not applicable No public exploit Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2.
CVE-2026-126361 Low 2026-11-13 Not applicable No public exploit Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5.
CVE-2026-126359 Low 2026-11-13 Not applicable No public exploit Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when &lt; ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the &lt;Style /&gt; element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after &lt; in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16.
CVE-2026-126316 Low 2026-11-13 Not applicable No public exploit Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key in the query string of outbound subscription status requests. Attackers with access to proxy, server, or monitoring logs along the request path can recover the site's subscription key from recorded URLs.
CVE-2026-126284 Low 2026-11-13 Not applicable No public exploit NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NC_ALLOW_LOCAL_HOOKS or NC_WEBHOOK_ALLOW_PRIVATE_NETWORK is set, attackers can request internal services via URLs ending in CSV or spreadsheet extensions and read the responses.
CVE-2026-125711 Low 2026-11-13 Not applicable No public exploit The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
CVE-2026-125659 Low 2026-11-13 Not applicable No public exploit This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpoints. These endpoints perform file system enumeration using the LocalSystem account without adequately validating the requesting caller's authorization. An unauthenticated attacker on the same LAN could exploit this vulnerability by sending malicious webpage to the local HTTPS Web API. Successful exploitation of this vulnerability could allow the attacker to enumerate file and directory names and obtain information about the directory structure of the targeted system. The vulnerability however, does not provide access to file contents or permit file modification, deletion, or code execution, or access to cryptographic keys and hardware token PINs.
CVE-2026-124760 Low 2026-11-13 Not applicable No public exploit P-Net before 1.0.4 sets the alarm receiver state to waiting for confirmation before the data of a received alarm notification is parsed. If the parsing fails the state is not restored, and later alarm notifications of the same priority are discarded without acknowledge until the Application Relationship is released. The Application Relationship and the cyclic data exchange keep working. The attacker must be able to send an alarm notification in the context of an established Application Relationship and requires ADJACENT network access.
CVE-2026-124758 Low 2026-11-13 Not applicable No public exploit P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length smaller than the header underflows and the handlers receive a data length of about 65530. The fixed-size reads of the I&M and PDPort handlers can then read past the end of the session buffer. The result of the write is discarded. The attacker must have an established Application Relationship or be able to send in the context of one, and requires ADJACENT network access.
CVE-2026-124719 Low 2026-11-13 Not applicable No public exploit Authentication bypass by spoofing vulnerability in Apache APISIX. When a Route's configured headers carry a caller identity and the OpenAPI document declares the same header, a caller can act as another identity against the upstream API. This issue affects Apache APISIX: from 3.19.0 before 3.20.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.
CVE-2026-115871 Low 2026-11-13 Not applicable No public exploit The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function, where the `deleteDir` parameter is only stripped of whitespace and double slashes by `sanitizePath()` without removing `..` traversal sequences or enforcing containment within the staging directory, leaving the sole pre-deletion guard as a simple string equality check against the WordPress home path. This makes it possible for authenticated attackers, with administrator-level access and above, to recursively delete arbitrary directories on the server — including `wp-content`, `wp-admin`, or directories outside the WordPress installation on shared hosting — resulting in denial of service or permanent data loss. An attacker must sequence a clone start, cancellation, and restart to drive the `delete_job` cache into the `directory` step before re-cancelling with a manipulated `deleteDir` value supplied via the `wp_ajax_wpstg_cancel_clone` endpoint.
CVE-2026-103645 Low 2026-11-13 Not applicable No public exploit An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected.
CVE-2025-71460 Low 2026-11-13 Not applicable No public exploit Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user.
CVE-2026-82292 Low 2026-11-12 Not applicable No public exploit A NULL pointer dereference vulnerability in the Qt Framework QDomDocument::setContent() XML parsing path of the Qt XML module (qtbase).
CVE-2026-19809 Low 2026-11-12 Not applicable No public exploit The user-mode system call verifier z_vrfy_charger_get_prop() in drivers/charger/charger_handlers.c declares an uninitialized union charger_propval k_val on the kernel (privileged) stack, passes it to the charger driver back end via z_impl_charger_get_prop(), and then copies the full sizeof(union charger_propval) back into the calling user thread's buffer with k_usermode_to_copy(). That discloses kernel stack contents on two paths: On error. The copy-out ignores the driver's return code. In-tree back ends return an error without writing through the value pointer for properties they do not implement: charger_gpio_get_prop() returns -ENOTSUP unconditionally, and bq24190_get_prop() has a default: return -ENOTSUP; arm that never touches val. The whole union is then stack residue. On success. A back end writes only the one union member the requested property selects (for example sbs_charger.c writes the one-byte val->present for CHARGER_PROP_PRESENT and returns 0), yet the handler still copies the whole union, so every byte beyond that member is uninitialized. The handler is compiled only when CONFIG_USERSPACE=y and is reachable by any user-mode thread that has been granted access to a charger device object. K_SYSCALL_DRIVER_CHARGER() validates only the device object and its API pointer, not the property identifier, so an unprivileged thread can choose prop freely: an unimplemented property forces the error path, a narrow one the success path, and the call can be repeated at will. Each call discloses up to the size of the union (12 bytes on a 32-bit target, 16 bytes on 64-bit targets where the function-pointer members widen it) of supervisor-stack memory. The bytes are residue of earlier kernel-side frames on the thread's privileged stack and can contain kernel object addresses and saved return addresses, which an unprivileged thread cannot otherwise observe and which help defeat address-layout assumptions when exploiting a separate memory-safety defect. There is no integrity or availability impact. Two commits fix it, and both are needed. 5054384e983c skips the copy-out when the back end reports an error. c31cac727d02 zeroes the union before the driver call, so the bytes copied out on success are driver-written data or zeros. A tree carrying only the first still leaks on every successful call.
CVE-2026-16240 Low 2026-11-12 Not applicable No public exploit Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-16052 Low 2026-11-12 Not applicable No public exploit The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output formats. An attacker who can control these values could use this to relax the cookie's Domain or SameSite restrictions.
CVE-2026-126996 Low 2026-11-12 Not applicable No public exploit A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_llm_modulator/utils/model_loading.py of the component Checkpoint Loading. Executing a manipulation of the argument base_model_name_or_path can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-126995 Low 2026-11-12 Not applicable Proof of concept only A vulnerability was found in tjake Jlama up to 0.8.4/0.9.0-beta. Affected by this vulnerability is the function SafeTensorIndex.loadWeights of the file jlama-core/src/main/java/com/github/tjake/jlama/safetensors/SafeTensorIndex.java. Performing a manipulation of the argument weight_map results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-126994 Low 2026-11-12 Not applicable Proof of concept only A vulnerability has been found in braindecode up to 1.8.1. Affected is the function resolve_type_kwargs of the file braindecode/models/util.py of the component Model Config Deserialization. Such manipulation of the argument Activation leads to use of externally-controlled input to select classes or code. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is 05b764d93b9a50400f523206fbe03d73d0cf5edb. The affected component should be upgraded.
CVE-2026-126644 Low 2026-11-12 Not applicable No public exploit A link-following flaw was found in the authorized_key module of the ansible.posix collection, residual to the fix for CVE-2026-11837. That fix guards only the final path component (os.chown with follow_symlinks=False and O_NOFOLLOW in _safe_open_write()). When an unprivileged local user replaces their ~/.ssh directory with a symlink to a directory they do not own, and an operator subsequently runs the authorized_key task as root (a common provisioning pattern), the module resolves its path operations through the symlink: atomic_move() writes the temporary file in the symlink target and renames it to <target>/authorized_keys, creating or overwriting a file in the attacker-chosen directory, and os.chmod(sshdir, 0o700) follows the symlink and changes the target directory's permissions. The written file is chowned to the unprivileged user, so this is not a privilege escalation, but it allows an attacker to create or overwrite files (for example in /etc/apt/apt.conf.d/, which APT reads regardless of file ownership) to cause integrity and availability impacts.
CVE-2026-126349 Low 2026-11-12 Not applicable No public exploit Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1.
CVE-2026-126347 Low 2026-11-12 Not applicable No public exploit Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using  tornado.web.RedirectHandler  with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1.
CVE-2026-126330 Low 2026-11-12 Not applicable No public exploit Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned host-port mapping. The daemon removes the active binding but retains the original publication request, allowing a later port change or sandbox restart to publish the service again on a new host port. An attacker able to reach the restored endpoint may regain access to the service. Both TCP and UDP mappings are affected. Exposure is limited to the original bind address, which defaults to loopback. The issue is fixed in version 0.53.0.
CVE-2026-126204 Low 2026-11-12 Not applicable No public exploit express-rate-limit is a basic rate-limiting middleware for Express. From 8.6.0 until 8.7.2, the built-in MemoryStore returns a Client whose mutable resetTime object is retained by middleware using skipFailedRequests or skipSuccessfulRequests. When a later request resets the client window, MemoryStore.resetClient mutates that same Date, so an earlier request that finishes or disconnects after the reset can pass the stale-window guard and decrement the current window's count. A client able to keep requests in flight across the boundary can obtain a bounded extra burst of up to one additional configured limit in the new window; the behavior does not increase the sustained rate. Stores that return a fresh Date are not affected. This issue is fixed in version 8.7.2.
CVE-2026-126198 Low 2026-11-12 Not applicable No public exploit pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the bundled clients, including the CLI and web client, decided whether to request write confirmation by checking only for the query_database tool name instead of server-published write annotations. Custom pl-do, pl-func, and writing sql tools therefore ran without confirmation on allow_writes connections, including when a model followed instructions in retrieved content. The affected control is a bundled-client warning rather than a server authorization boundary, and other MCP clients do not inherit that prompt. This issue is fixed in 1.1.0.
CVE-2026-125870 Low 2026-11-12 Not applicable No public exploit BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies on Page::getPage() which returns null for soft-deleted pages and silently skips the PageView check. Attackers can enumerate sequential image IDs via GET /images/edit/{id} to disclose metadata of restricted images, and users with image-update-all/image-delete-all privileges can rename, replace, or permanently delete images belonging to content they cannot view, persisting the damage even after the page is restored.
CVE-2026-120490 Low 2026-11-12 Not applicable No public exploit On Scalable Platforms, an administrator with permissions to edit and install the Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface, bypassing the built-in Sync protection. This could allow the administrator to execute operating system commands and write files on the Gateway with superuser privileges.
CVE-2026-118631 Low 2026-11-12 Not applicable No public exploit Philips Hue Bridge Pro Argument Injection Restricted File Write Vulnerability. This vulnerability allows local attackers to modify files on affected installations of Philips Hue Bridge Pro. An attacker must first obtain the ability to execute low-privileged code within a container on the target system, in order to exploit this vulnerability. The specific flaw exists within the factory data service, which listens on TCP port 5001 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to modify files in the context of the service account. Was ZDI-CAN-33090.
CVE-2026-118531 Low 2026-11-12 Not applicable No public exploit The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not prevent a listing's own author from changing its status from pending to published, allowing users with a Subscriber-level account and above to bypass the administrator's listing moderation and publish their own pending listings.
CVE-2026-116303 Low 2026-11-12 Not applicable No public exploit Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-114467 Low 2026-11-12 Not applicable No public exploit Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures
CVE-2026-114369 Low 2026-11-12 Not applicable No public exploit Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module
CVE-2026-113408 Low 2026-11-12 Not applicable No public exploit Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository
CVE-2026-110041 Low 2026-11-12 Not applicable No public exploit The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and re-cropping media attachments, allowing any authenticated user with the upload capability (the Author role by default) to read the metadata of, and overwrite the generated thumbnail files and stored metadata of, media attachments belonging to other users.
CVE-2026-0460 Low 2026-11-12 Not applicable No public exploit Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity.
CVE-2026-91892 Low 2026-11-11 Not applicable No public exploit Dell Terraform Provider for PowerFlex, versions prior to 1.9.0, contains a vulnerability  that may permit the use of deprecated cryptographic protocols during secure communications. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure.
CVE-2026-76080 Low 2026-11-11 Not applicable No public exploit Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes Query.node(id:) with @authentication(required: OPTIONAL) — an unauthenticated internet visitor to any published trust center can call it. Six of its type branches — Organization, Framework, Audit, ThirdParty (subprocessor), TrustCenter, and TrustCenterReference — resolve the object with a tenant scope derived from the client-supplied GID itself (coredata.NewScopeFromObjectID(id)) and load it with a bare Get(scope, id) that performs no comparison to the current trust center's OrganizationID and no showOnTrustCenter/visibility check. (The Document and File branches, by contrast, correctly pass trustCenter.OrganizationID and check visibility). This issue has been patched in version 0.224.0.
CVE-2026-76078 Low 2026-11-11 Not applicable No public exploit Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Prior to version 0.224.0, the public Trust Center GraphQL API exposes acceptElectronicSignature and recordSigningEvent, both gated only by @authentication(required: PRESENT) @sessionOnly — any self-provisioned trust center identity can call them. The underlying esign.Service.AcceptSignature and esign.Service.recordEvent build the tenant scope from the client-supplied signatureId GID (coredata.NewScopeFromObjectID(req.SignatureID)) and load the signature by that GID. At no point do they verify that the signature belongs to the caller or that the caller's email matches the signature's SignerEmail. As a result, any authenticated trust-center visitor who possesses another visitor's signature GID can: (1) complete that visitor's NDA signature — overwriting signer name/IP/UA with attacker data and setting status to Accepted, which triggers the sealing worker to generate a completion certificate; (2) inject arbitrary audit-trail events into any signature's log. Both attacks defeat the non-repudiation and integrity guarantees of the e-signature system. This issue has been patched in version 0.224.0.
CVE-2026-68549 Low 2026-11-11 Not applicable No public exploit ClickMigrate is a database migration tool for ClickHouse with automatic SQL migration management and version tracking. Prior to version 1.0.3, a path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations directory. Under specific conditions, an attacker could cause the tool to create a .sql file in an arbitrary location writable by the user executing the command. This issue is only exploitable if an attacker can influence the migration name passed to the revision command, such as through an insecure automation or CI/CD pipeline that forwards untrusted input. This issue has been patched in version 1.0.3.
CVE-2026-61637 Low 2026-11-11 Not applicable No public exploit Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Prior to versions 2.12.7 and 2.13.1, an attacker can craft a URL that, once visited by an authenticated user (or one that is able to authenticate), allows to manipulate the backend to redirect the user to any location. For this to succeed, the victim's locale in Icinga Web must be different from en_US. This issue has been patched in versions 2.12.7 and 2.13.1.
CVE-2026-126922 Low 2026-11-11 Not applicable No public exploit Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126913 Low 2026-11-11 Not applicable No public exploit Out of bounds read in Compositing in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126907 Low 2026-11-11 Not applicable No public exploit Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126894 Low 2026-11-11 Not applicable No public exploit Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126882 Low 2026-11-11 Not applicable No public exploit Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126853 Low 2026-11-11 Not applicable No public exploit Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126848 Low 2026-11-11 Not applicable No public exploit Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126845 Low 2026-11-11 Not applicable No public exploit Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126844 Low 2026-11-11 Not applicable No public exploit Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126841 Low 2026-11-11 Not applicable No public exploit Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126798 Low 2026-11-11 Not applicable Proof of concept only NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted forms on crawled sites to store JavaScript that executes when users view asset details, stealing localStorage access tokens to hijack sessions, including administrators.
CVE-2026-126775 Low 2026-11-11 Not applicable No public exploit Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that restores sessions named in the unsigned RelayState parameter. Attackers can deliver their own valid IdP response and RelayState to a victim's browser via an auto-submitting form, signing the victim into the attacker's account to capture entered data.
CVE-2026-126758 Low 2026-11-11 Not applicable Proof of concept only A vulnerability was detected in Moonshot AI Kimi Code up to 2.0.2. This vulnerability affects unknown code of the file .kimi-code/local.toml of the component WorkspaceDirsService. Performing a manipulation of the argument additional_dir results in reliance on untrusted inputs in a security decision. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 2.1.0 is able to resolve this issue. Upgrading the affected component is recommended.
CVE-2026-126757 Low 2026-11-11 Not applicable No public exploit A security vulnerability has been detected in Moonshot AI Kimi Code up to 2.5.2. This affects the function isOriginAllowed of the file apps/kimi-code/dist-web/assets/index-HU0LCM-X.js of the component Web UI. Such manipulation of the argument kimi_origin leads to open redirect. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-126216 Low 2026-11-11 Not applicable No public exploit A improper privilege management vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2.0 through 7.2.12, FortiManager Cloud 8.0.0 through 8.0.1, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2.1 through 7.2.12 may allow an authenticated administrator to escalate their privileges, bypass authorization controls or impersonate internal services via specially crafted requests to the GUI.
CVE-2026-126188 Low 2026-11-11 Not applicable No public exploit Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer pass uploaded blob contents to FFmpeg without restricting the demuxer. A direct upload can retain a client-declared video/* or audio/* content type for an HLS playlist. FFmpeg content probing selects the hls demuxer, which opens attacker-named file:// segments when the blob is previewed or analyzed. Applications that accept untrusted uploads and generate video previews or analyze video or audio attachments can disclose a local media file readable by the application process when the attacker knows its path. This issue is fixed in versions 8.0.5.2 and 8.1.4.1.
CVE-2026-123862 Low 2026-11-11 Not applicable No public exploit An uncatchable exception in the Node.js zlib streaming API lets a peer crash a process by disconnecting while data is being compressed. zlib.params() queues a flush and completes its work in that write's callback; if the stream is destroyed first, as pipeline() does when the peer goes away, Writable still invokes the callback with an error, but the callback ignores its arguments and asserts that the native handle still exists. The handle is gone, so an ERR_INTERNAL_ASSERTION is thrown from inside stream internals and bypasses the stream's error event, the params() callback, and the pipeline() callback, terminating the process. An application is affected only if it calls deflate.params() while streaming to a peer, which is uncommon. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVE-2026-123829 Low 2026-11-11 Not applicable No public exploit A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVE-2026-122087 Low 2026-11-11 Not applicable No public exploit The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.
CVE-2026-119033 Low 2026-11-11 Not applicable No public exploit The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a user may edit a post before letting them change that post's structured data settings, allowing users with the Contributor role and above, when an administrator has granted them access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70, to disable, alter or reset the structured data of posts they do not own.
‹ prev page 1 of 179 next ›