Daily summary
Vulnerabilities of 1 November 2026: 515 new, 64 critical, 3 newly exploited
515 vulnerabilities added on 1 November 2026, 64 critical and 186 high: Adobe Experience Manager (34), Adobe ColdFusion (30), Payload CMS (24) and more. 3 vulnerabilities newly listed as exploited by CISA.
- 64 critical
- 186 high
- 220 medium
- 21 low
- 24 unrated
- 3 newly exploited
Newly listed as exploited
Added to CISA's Known Exploited Vulnerabilities catalog: attackers use them.
- 8.6Cisco ASA and Firepower Threat DefenseA vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat…
- 7.0Ivanti Connect SecureIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root,…
- 2.7VMware ESXiVMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being…
Adobe Experience Manager
34 vulnerabilities · Servers and applications
- 10.0Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current…
- 10.0Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current…
- 10.0Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current…
- 9.9Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current…
- 9.9Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current…
Show 29 more
- 9.6Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege…
- 9.3Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious…
- 9.3Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into…
- 9.3Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into…
- 9.1Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current…
- 7.7Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in…
- 7.1Adobe Experience Manager is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could…
- 7.1Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject…
- 5.4Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to…
- 5.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject…
- 5.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject…
- 5.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject…
- 5.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject…
- 5.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM…
- 5.4Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject…
Adobe ColdFusion
30 vulnerabilities · Servers and applications
- 10.0ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not…
- 10.0ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…
- 10.0ColdFusion is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the…
- 9.9ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 9.9ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…
Show 25 more
- 9.6ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An…
- 9.6ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage…
- 9.1ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the…
- 9.0ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An…
- 8.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 8.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 8.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 8.8ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 8.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 8.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 8.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 8.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not…
- 8.6ColdFusion is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. An…
- 8.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not…
- 8.4ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An…
- 8.4ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An…
- 8.2ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 7.8ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A…
- 7.7ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could…
- 7.7ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage…
- 7.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. An attacker with high privileges could…
- 7.5ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this…
- 7.5ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this…
- 7.5ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this…
- 7.1ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could…
Payload CMS
24 vulnerabilities · Servers and applications · most fixed in 3.90.0
- 10.0Payload is a free and open source headless content management system. In @payloadcms/plugin-form-builder versions before 3.90.0 and canary versions before…
- 9.8Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can…
- 9.3Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the…
- 9.2Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a…
- 8.8Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before…
Show 19 more
- 8.7Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a collection that…
- 8.7Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a…
- 8.6Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload…
- 8.6Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access…
- 8.1Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated…
- 8.1Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, a crafted request…
- 7.7Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users…
- 7.6Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails…
- 7.2Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload…
- 7.1Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before…
- 7.1Payload is a free and open source headless content management system. In @payloadcms/db-mongodb versions before 3.87.0 and canary versions before…
- 7.1Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before…
- 7.1Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, token…
- 7.1Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a user…
- 6.9Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated…
- 6.9Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a…
- 6.4Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before…
- 6.1Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an…
- 5.3Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before…
Incus
18 vulnerabilities · Servers and applications · most fixed in 7.6.0
- 10.0Authentication and authorization bypass through unverified client certificate chains
- 9.9Container configuration injection through OCI image config and oci.* keys
- 9.9Restricted clients can create and access resources in the default project
- 9.9Path traversal, crash and storage pool restriction bypass through dependent volumes in migration
- 9.9Restricted project users can create resources in the default project, bypassing project isolation (host root via dnsmasq, host file read via mkfs)
Show 13 more
- 9.9Restricted project users can read or overwrite host files through special files, hard links or symlinks in backup or image metadata
- 9.6Token operations exposed through the event stream and cancellable by any client
- 9.6Path traversal through snapshot names in custom volume backups
- 8.8Rebuilding a never-started container makes it boot without a user namespace, running as privileged
- 8.5Guest API caller impersonation through a forged cgroup name
- 8.4Local users can hijack VM NBD migration and disk-export sockets
- 7.7Restricted and view-only clients can read resources in the default project
- 7.1Incus exposes migration websocket secrets to project event listeners, allowing migration hijack
- 6.5S3 listener buffers signed request bodies before authentication
- 6.5Incus guest-API image export ignores the guest's project, exposing other projects' images
- 6.5Recursive and all-projects responses disclose other projects' bucket S3 keys and profile configuration to restricted clients (incomplete fix of…
- 6.5Denial of service via a null snapshot entry in an instance backup
- 5.0Incus broadcasts OVN ACL log events with an empty project, leaking them across projects
TeamCity
5 vulnerabilities · Servers and applications · most fixed in 2025.11.8, 2026.1.4
- 10.0In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
- 9.8In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
- 7.5In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
- 5.4In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
- 5.4In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
pgAdmin
15 vulnerabilities · Servers and applications · most fixed in 9.19
- 9.9pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
- 8.5pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username
- 8.4pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
- 8.2pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate
- 8.2pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
Show 10 more
- 8.2pgAdmin 4: Connection services are not restricted in server mode
- 8.2pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
- 8.1pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
- 7.5pgAdmin 4: Utility binary path can point at a shared storage directory
- 6.8pgAdmin 4: Non-administrators can share a server with every user
- 6.5pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name
- 6.5pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check
- 6.5pgAdmin 4: Server passwords are left in pgAdmin's process environment
- 6.5pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked
- 4.2pgAdmin 4: A user's other sessions survive a change of their password
Langflow
57 vulnerabilities · Servers and applications
- 9.8Langflow OSS is affected by multiple
- 9.8Langflow OSS is affected by multiple
- 9.8Langflow OSS is affected by multiple
- 9.8Langflow OSS is affected by multiple
- 9.8Langflow OSS is affected by multiple
Show 52 more
- 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS…
- 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.
- 9.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper control of code generation.
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8Langflow OSS is affected by multiple
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements…
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper input validation.
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements…
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an incomplete blocklist in the code security scanner.
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements…
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.
- 8.8IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper access control.
- 8.3IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper…
- 8.1IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary OS commands due to improper neutralization of special…
- 7.7Langflow OSS is affected by multiple
- 7.6IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization.
- 7.5Langflow OSS is affected by multiple
- 7.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow an attacker with access to the server secret and Redis write access to submit a malicious serialized cache…
- 6.8Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5Langflow OSS is affected by multiple
- 6.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensitive information to…
- 6.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
- 6.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to…
- 6.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to…
- 6.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials.
- 6.5IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper access control.
- 5.4Langflow OSS is affected by multiple
- 4.3Langflow OSS is affected by multiple
- 4.3Langflow OSS is affected by multiple
- 4.3Langflow OSS is affected by multiple
- 4.3IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption during…
Gitea
48 vulnerabilities · Servers and applications
- 9.8Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For…
- 9.8Gitea's OAuth2 and OpenID Connect sign-in paths do not require a WebAuthn challenge when WebAuthn is the account's only configured second factor. A party able…
- 9.1Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the token was a refresh…
- 9.1Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path…
- 9.1When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` comparison of its encoded…
Show 43 more
- 8.8A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting…
- 8.8Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only…
- 8.1The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handler with release…
- 8.1When Gitea's web installer is reachable against a database that already contains users, such as after `INSTALL_LOCK` has been reset to `false`, submitting the…
- 8.1Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed…
- 7.7When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address against the…
- 7.5A repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue…
- 7.5Gitea expanded a workflow's static `strategy.matrix` into its full Cartesian product without a size limit when creating a run, before the fork pull request…
- 7.5Gitea validates a repository migration hostname against its network allow and block lists before invoking Git, but the Git subprocess independently resolves…
- 7.5Gitea validated the initial remote URL for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but the subsequent raw Git operations…
- 7.5When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still…
- 7.1The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security]…
- 7.1When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated…
- 6.5When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its paginated downloads.…
- 6.5When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link,…
- 6.1The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the…
- 5.4With `[repository] FORCE_PRIVATE = true`, Gitea creates new repositories as private, but the post-receive hook still applied the `repo.private=false` push…
- 5.4Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a…
- 4.9The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the…
- 4.3The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments that belong to…
- 4.3With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and…
- 4.3When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review…
- 4.3Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was…
- –Gitea limited-visibility profile disclosure with public-only tokens
- –Gitea user and organization feed token scope bypass
- –Gitea private pull request disclosure on project boards
- –Gitea public-only token bypass on bulk organization repository deletion
- –Gitea issue changes on archived repositories through the API
- –Gitea public-only token bypass in repository and organization creation
- –Gitea OAuth2 userinfo private group disclosure to public-only tokens
- –Gitea public-only package token access to private OCI blobs
- –Gitea Helm chart upload decompression denial of service
- –Gitea private issue disclosure through issue dependency timeline events
- –Gitea private repository listing to public-only tokens on profiles
- –Gitea admin API public-only token scope bypass
- –Gitea Actions job token spoofing of instance-signed commits
- –Gitea archived repository release, milestone and label modification
- –Gitea public-only token bypass through Actions runner registration
- –Gitea contribution heatmap private activity disclosure to public-only tokens
- –Gitea stored XSS through legacy Actions artifact Content-Encoding
- –Gitea Actions task token private repository enumeration
- –Gitea OAuth2 account auto-linking takeover through the sign-up form
- –Gitea Actions fork workflow trust through pull request review commit
Splunk Enterprise
34 vulnerabilities · Servers and applications · most fixed in 10.0.10, 10.2.7, 10.4.3
- 9.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review…
- 9.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review…
- 9.8In Splunk Enterprise versions below 10.4.3 and 10.2.7, an unauthenticated user with network access to the Patroni Representational State Transfer (REST)…
- 8.8In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar…
- 8.8In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the…
Show 29 more
- 8.8As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review…
- 7.7In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15 on Linux, a local user who can run commands as the user account running Splunk…
- 7.6As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review…
- 7.5In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the Splunk Web…
- 7.5In Splunk Enterprise versions below 10.4.4, 10.2.8, and 10.0.11, an unauthenticated user could send repeated requests to the Edge Processor package download…
- 7.2In Splunk Enterprise versions below 10.4.3, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the edit_manager_xml capability could execute arbitrary…
- 6.5In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a…
- 6.5In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could make the Splunk…
- 6.5In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a…
- 6.5In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could redirect an outbound…
- 6.5In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, a user who does…
- 6.5In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a…
- 6.5In Splunk Enterprise versions below 10.4.3, a user that holds a role with the list_spl2_modules capability could use SQL injection in SPL2 module filtering to…
- 6.3In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, and Splunk Secure Gateway versions below 3.10.11, 3.9.25, and 3.8.72, an…
- 5.4In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could trick a user that holds a role with the…
- 5.4In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_management_pipeline_job…
- 4.3In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could move field…
- 4.3In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, and Splunk Secure Gateway versions below 3.10.12, 3.9.26, and 3.8.73, a user who does…
- 4.3In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could create, move,…
- 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the…
- 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search…
- 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk…
- 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the run_collect capability could use the collect Search…
- 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could access search…
- 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could retrieve…
- 4.3In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit…
- 4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the read_o11y_content capability could inject forged entries…
- 4.1In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edit_user capability could create a native Splunk…
- –As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review…
MOVEit Transfer
12 vulnerabilities · Servers and applications · most fixed in 2025.1.6, 2026.0.4
- 9.8Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from…
- 9.8Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before…
- 8.8Incorrect implementation of authentication algorithm vulnerability in Progress MOVEit Transfer (SFTP module). This issue affects MOVEit Transfer: before…
- 8.8Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Progress MOVEit Transfer (LDAP module). This issue…
- 8.8Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module). This issue affects MOVEit Transfer: before 2025.1.6 and from…
Show 7 more
- 8.8Improper handling of unicode encoding vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before…
- 8.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Progress MOVEit Transfer (Custom Reports module). This…
- 8.8Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from…
- 8.8Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and…
- 7.5Authentication bypass by capture-replay vulnerability in Progress MOVEit Transfer (OIDC module). This issue affects MOVEit Transfer: before 2025.1.6 and from…
- 7.3Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0…
- 5.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer (Ad Hoc module). This issue…
Apache Struts
4 vulnerabilities · Servers and applications · most fixed in 6.12.0, 7.4.0
- 9.8Improper neutralization of special elements used in an expression language statement ('Expression Language Injection') vulnerability in Apache Struts. If the…
- 8.8Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats…
- 7.5Asymmetric resource consumption (amplification) vulnerability in Apache Struts. When a request parameter is bound to an arbitrary-precision decimal…
- 6.5Allocation of resources without limits or throttling vulnerability in the Apache Struts REST plugin. A request body is read into memory without any bound on…
Remote code execution in servers and applications
4 vulnerabilities
- 9.5ClickHouseUnauthenticated RCE vulnerability against ClickHouse Server
- 9.0FlowiseFlowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore
- 8.6Palo Alto Networks PAN-OSA remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated attacker with network…
- –DrupalDrupal core - Critical - Remote code execution - SA-CORE-2026-014
Nginx UI
9 vulnerabilities · Servers and applications · most fixed in 2.5.0
- 9.4Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit…
- 8.8Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutation operations and…
- 8.8Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret…
- 8.8Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential…
- 8.8Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /api/nodes/:id,…
Show 4 more
- 8.1Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion…
- 8.1Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the…
- 7.5Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary only with a…
- 7.5Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of…
SQL injection in WordPress plugins
1 vulnerability
- 9.3BookIt
Parse Server
28 vulnerabilities · Servers and applications
- 9.1Custom auth adapters that extend the AuthAdapter class accept any authData
- 8.8Unauthenticated deletion of class schemas removes class-level permissions on MongoDB
- 8.7Pre-authentication denial of service via email address format regex backtracking
- 8.2Object update with a dot notation key below a pointer field can terminate the server process
- 6.9User update runs checks against the target account before authorization
Show 23 more
- 6.3LiveQuery subscriptions can receive installations and objects of other internal classes without the master key
- 6.3Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID
- 6.3Object write with a null dot notation key can corrupt a field or make reads fail on MongoDB
- 6.3Installation update is written to the installation named by the request's installation ID instead of the addressed object
- 6.3Object write with a reserved field name can make reads fail on MongoDB
- 6.0Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service
- 6.0Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQuery
- 6.0Object write with a crafted key can pollute a shared prototype and cause denial of service
- 6.0LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens
- 5.3Relation `$relatedTo` query using an operator instead of an object ID bypasses owning-object ACL
- 2.3Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses
- 2.3Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys
- 2.3Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
- 2.3Dot notation operation on a missing field reveals whether the field is stored to a caller without read access
- 2.3Save response reveals whether a field is stored to a caller without read access
- 2.3Object create returns field values to a caller without read access
- 2.3Session upgrade endpoint creates an additional session from an already revocable session token
- 2.3Object update returns stored field values to a caller without read access
- 2.3Save response includes protected field values that a `beforeSave` trigger writes in dot notation
- 2.3Object update returns the stored value of a field reverted in `beforeSave` to a caller without read access
- 2.3Object write with a dot notation key can skip `afterSave` triggers and LiveQuery events
- 2.3Session creation endpoint bypasses create and addField class-level permissions
- 2.1SMS MFA login code request saves other login request fields with master privileges
Broken access control in servers and applications
8 vulnerabilities
- 9.1vsftpdvsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
- 8.8KibanaAuthorization Bypass Through User-Controlled Key (CWE-639) in Kibana could lead to cross-tenant data interception. In this context, "tenant" refers to a user…
- 6.3RancherAuthorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
- 6.0ProFTPDProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass
- 5.3ProFTPDProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass
Show 3 more
- 4.3KibanaMissing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An…
- 2.3vsftpdvsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases
- 2.3OpenCartOpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points
IBM WebSphere Application Server
5 vulnerabilities · Servers and applications · most fixed in 26.0.0.11
- 9.1IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect…
- 9.1IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on…
- 9.1IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2.0 feature is…
- 8.2IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persisted status of batch…
- 7.5IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.
Authentication bypass in servers and applications
4 vulnerabilities
- 9.1ZITADELZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie
- 8.6ZITADELZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval
- 8.6ZITADELZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection
- 8.6Ivanti Connect SecureAuthentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact…
Chamilo LMS
4 vulnerabilities · Servers and applications · most fixed in 2.0.1
Froxlor
6 vulnerabilities · Servers and applications
- 8.8Local privilege escalation via missing symlink containment in the root traffic cron's `chown -R`, enabling takeover of any host directory
- 7.2Unscoped API keys listing leaks every account's API key and secret to a customers_see_all admin, enabling super-admin takeover
- 5.4Missing authorization via unchecked `parentdomainid` in `SubDomains.delete`, enabling deletion of a reseller-assigned main domain
- 5.4Froxlor: Certificates.add/update API overwrites Let's Encrypt-managed certificates and private keys, bypassing the "not editable" boundary fixed in 2.3.13…
- 4.3Authorization bypass via identifier confusion in `Admins.get`, enabling a reseller to read any admin's record
- 4.3Mysqls.add API bypasses customer_hide_options policy allowing customers to create databases when MySQL feature is admin-disabled
n8n
29 vulnerabilities · Servers and applications
- 8.7n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes
- 8.7Deprecated Code Nodes Allow Code Execution in the n8n Main Process
- 8.4Webhook Responses Without the Sandbox Policy Allow Stored Cross-Site Scripting
- 8.2n8n from 2.14.0 through 2.46.3 Path Traversal via Databricks Node
- 7.7Insufficient Isolation in Workflow Expression Evaluation
Show 24 more
- 7.7Insecure GraphicsMagick Configuration
- 7.2Crafted Workflow ID Gives Access to Data Tables in Other Projects
- 7.1Read/Write Files Node Glob Pattern Causes Unbounded Event-Loop Block
- 7.1Prototype Pollution in Workflow History Compaction Causes Denial of Service
- 6.3NocoDB Node Sends Its API Token to Attacker-Chosen Hosts When Downloading Attachments
- 6.3Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects
- 6.3Asana Trigger: Unauthenticated Request Can Reset Webhook Verification Secret
- 6.3Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests
- 6.3Unauthenticated Slack Token Exfiltration and Full-Response SSRF via the Slack Trigger Webhook
- 6.0Browser Use Upload Tool Reads Arbitrary Files from the n8n Server
- 5.9Local Gateway Deep-Link Connect Silently Re-pairs to Attacker-Controlled Instance
- 5.3MongoDB Node Update Operations Can Modify Unintended Documents
- 5.3OData $filter Injection in Microsoft Outlook and SharePoint v1 Nodes
- 5.3SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data
- 5.3Chat Hub: chat-only users can register tool types the product already tries to sandbox
- 5.3Quick Base Node Allows Filter Injection Through the Where Parameter
- 5.3Credential Secrets Exposed in Execution Error Data of Several Nodes
- 5.1Open Redirect via MCP OAuth Dynamic Client Registration
- 5.1Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value
- 5.1Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard
- 5.1Credential Permission Check Skips Nodes Whose Default Parameters Are Omitted
- 5.1Per-User Credential Theft via Error-Workflow Execution Context Inheritance
- 4.9SQL Injection via Metadata Filter Key in the Vector Store (OracleDB) Node
- 4.8OAuth Account Hijack in the End-User Credential Connect Flow via Unauthenticated Callback
OPNsense
5 vulnerabilities · Servers and applications · most fixed in 26.7.8
- 8.6OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
- 6.9OPNsense core before 26.7.8 Lockout IP Planting via WebGUI Login Username
- 6.1OPNsense before 26.7.8 Wireless WPA Configuration Line Injection via Identity
- 6.0OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
- 5.3OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
Roundcube
12 vulnerabilities · Servers and applications · most fixed in 1.6.20, 1.7.5
- 8.5Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the…
- 8.3Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as…
- 8.1Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!”…
- 8.1Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin.…
- 7.1Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit…
Show 7 more
- 6.1Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a…
- 5.8Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action.…
- 5.8Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The…
- 5.3Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml…
- 5.0Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only…
- 4.3Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin…
- 3.1Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action…
SQLite
11 vulnerabilities · Servers and applications · most fixed in 3.54.0
- 8.5SQLite CLI through 3.54.1 Command Injection via .recover Output
- 8.5SQLite before 3.54.0 Heap Buffer Overflow via Session Extension sessionUpdateFind()
- 8.5SQLite before 3.54.0 FTS5 Heap Buffer Overflow via fts5MergeRowidLists()
- 8.5SQLite before 3.54.0 Heap Buffer Overflow via FTS5 fts5DoSecureDelete()
- 6.8SQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
Show 6 more
- 6.8SQLite before 3.54.0 Use-After-Free in R-Tree nodeWrite()
- 6.8SQLite before 3.54.0 Stack Exhaustion via COLLATE Operator Chain
- 6.8SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
- 6.8SQLite before 3.54.0 Use-After-Free in FTS3 fts3BestSnippet() via snippet()
- 6.8SQLite before 3.54.0 Stack Exhaustion via CTE Chain in selectExpander()
- 2.0SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING
ImageMagick
23 vulnerabilities · Servers and applications
- 8.2ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy…
- 7.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built…
- 7.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an…
- 7.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an…
- 7.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the…
Show 18 more
- 7.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive…
- 7.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check…
- 7.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger…
- 6.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values…
- 6.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel…
- 6.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client…
- 6.3ImageMagick before 7.1.2-34 Stack Overflow in TIFF Decoder
- 5.5ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the…
- 5.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed…
- 5.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can…
- 5.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth…
- 5.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened…
- 5.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in…
- 5.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded…
- 5.3ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR…
- 4.8ImageMagick before 7.1.2-34 Heap Buffer Overflow via -morph Option
- 4.4ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the…
- 1.8ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml…
Traefik
13 vulnerabilities · Servers and applications · most fixed in 3.7.14
- 8.2Traefik 3.2.0 before 3.7.15 FastProxy Data Race Denial of Service
- 7.0Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider
- 7.0Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by…
- 7.0Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil.…
- 7.0Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough…
Show 8 more
- 7.0Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin…
- 7.0Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when…
- 7.0Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization:…
- 7.0Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied…
- 6.9Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks…
- 6.4Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider,…
- 6.3Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where the…
- 2.1Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret
phpMyAdmin
7 vulnerabilities · Servers and applications
- 7.7phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
- 7.6phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
- 6.3phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
- 5.3phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
- 5.1phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
FFmpeg
15 vulnerabilities · Servers and applications
- 7.1FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect…
- 7.1FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because…
- 6.8FFmpeg 2.3 through 9.0.2 Huffyuv Decoder Uninitialized Heap Memory Disclosure
- 6.8FFmpeg 4.4 through 9.0.2 Uninitialized Memory Disclosure via CDXL HAM Decoder
- 6.8FFmpeg 2.1 through 9.0.2 Uninitialized Memory Leak via PCX Decoder
Show 10 more
- 6.8FFmpeg 0.10 through 9.0.2 Uninitialized Memory Disclosure via Sun Raster Decoder
- 6.8FFmpeg 2.0 through 9.0.2 Information Disclosure via G2M Kempf Palette
- 6.3FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips…
- 6.0FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to…
- 5.7FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty…
- 5.7FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees…
- 5.3FFmpeg 5.0 through 9.0.2 Path Traversal via IMF Demuxer ASSETMAP Path
- 5.3FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions…
- 5.3FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP…
- 4.8FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes…
Mattermost
15 vulnerabilities · Servers and applications · most fixed in 11.7.10, 11.8.6, 11.9.2
- 7.1Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST…
- 6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads…
- 6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in…
- 6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles…
- 6.5Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when…
Show 10 more
- 6.4Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an…
- 5.0Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when…
- 4.9Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type…
- 4.9Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to…
- 4.9Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other…
- 4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system…
- 4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search…
- 4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations…
- 4.3Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a…
- 4.3Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user…
Zimbra Collaboration
7 vulnerabilities · Servers and applications
- 7.1A cross-site request forgery vulnerability in the OAuth extension of Zimbra Collaboration Suite (ZCS) Network Edition allows an attacker to link an…
- 6.1A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an unauthenticated attacker to execute JavaScript…
- 5.4A CSS sanitization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user with Briefcase access to publish a document that displays…
- 5.3Stored Cross-Site Scripting in Zimbra
- 5.3Stored Cross-Site Scripting in Zimbra
Show 2 more
- 4.3A cross-account authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to insert forged shared-file records into another…
- 4.3An LDAP filter injection vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to query otherwise unreturned attributes of calendar…
Moodle
4 vulnerabilities · Servers and applications
- 7.1Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Blackboard Import Path Traversal
- 6.0Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber
- 5.3Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems
- 5.3Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback
Path traversal in servers and applications
2 vulnerabilities
Nuxt
4 vulnerabilities · Servers and applications · most fixed in 4.6.3
- 6.5Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
- 5.9Nuxt dev server exposes private runtime config through the Nitro dev bundle
- 5.9Nuxt dev server arbitrary file read through client error reports
- 4.8Nuxt dev server exposes generated appSecret through Vite file serving
Sensitive data exposure in servers and applications
2 vulnerabilities
Cross-site scripting in servers and applications
2 vulnerabilities
Other vulnerabilities in servers and applications
10 vulnerabilities
- 10.0LXDImproper certificate validation in the HTTPS listener in LXD
- 8.7NetScaler ADC and GatewayVulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before…
- 7.9RancherCluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace
- 7.8Microsoft Exchange ServerInclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
- 7.8Microsoft Exchange ServerDeserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Show 5 more
- 7.5Microsoft Exchange ServerImproper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- 6.9ForgejoForgejo through 15.0.11, 16.0.7, and 17.0.1 SSRF via OpenID Discovery
- 6.3Uptime KumaUptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
- 6.3ProFTPDProFTPD before 1.3.9e and 1.3.10rc5 Buffer Overflow via mod_rewrite utf8trans RewriteMap
- 4.3Open WebUIChannel members can post messages shown as a webhook via client-supplied message metadata
Other vulnerabilities in WordPress plugins
2 vulnerabilities
From NVD, the CVE Program, OSV.dev with the GitHub Advisory Database, WPVulnerability, WordPress's security advisories and CISA's Known Exploited Vulnerabilities catalog, as they stood when this was written. Each vulnerability's own page has its latest rating and fix. This product uses the NVD API but is not endorsed or certified by the NVD.