Filter
7.3CVSS
CVE-2026-129360 · Nov 15, 2026
A weakness has been identified in Linux Foundation Magma up to 1.9.0. The impacted element is an unknown function of the file orc8r/cloud/go/services/obsidian/access/operator.go of the component Obsidian REST. Executing a manipulation of th…
DEFERRED
HIGH
7.3CVSS
CVE-2026-129359 · Nov 15, 2026
A security flaw has been discovered in Linux Foundation Magma up to 1.9.0. The affected element is an unknown function of the file orc8r/lib/go/registry/interceptors.go. Performing a manipulation results in hard-coded credentials. The attac…
DEFERRED
HIGH
2.4CVSS
CVE-2026-129358 · Nov 15, 2026
A vulnerability was identified in Linux Foundation Magma up to 1.9.0. Impacted is the function handleReact of the file nms/server/main/routes.ts of the component NMS. Such manipulation leads to cross site scripting. It is possible to launch…
DEFERRED
LOW
6.3CVSS
CVE-2026-129357 · Nov 15, 2026
A vulnerability was determined in Linux Foundation Magma up to 1.9.0. This issue affects the function hostOrgMiddleware of the file nms/server/host/middleware.ts of the component Host Middleware. This manipulation of the argument role cause…
DEFERRED
MEDIUM
4.3CVSS
CVE-2026-129466 · Nov 15, 2026
Zr.Admin.NET commit 1845017 through commit eb9228a contains a missing authorization vulnerability in TasksController.Get that allows any logged-in user to read scheduled task details without the monitor:job permission. Attackers can obtain …
DEFERRED
MEDIUM
8.8CVSS
CVE-2026-129465 · Nov 15, 2026
Zr.Admin.NET commit af07ffc through commit eb9228a contains an insecure direct object reference vulnerability in SysProfileController.UpdateProfile that allows any authenticated user to modify other accounts via UserId. Attackers can set th…
DEFERRED
HIGH
8.8CVSS
CVE-2026-129464 · Nov 15, 2026
Zr.Admin.NET commit 0ee1ab8 through commit eb9228a contains a path traversal vulnerability that allows any logged-in user to read arbitrary server files via the path parameter of /common/DownloadFile. Attackers can supply absolute paths or …
DEFERRED
HIGH
5.4CVSS
CVE-2026-129455 · Nov 15, 2026
Zr.Admin.NET commit e6ceaf4 through commit eb9228a contains an insecure direct object reference vulnerability in FrontArticleController that allows authenticated users to change other users' article visibility and pin state. Attackers can s…
DEFERRED
MEDIUM
6.5CVSS
CVE-2026-129454 · Nov 15, 2026
Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET /workflow/instance/{instanceId} that lets logged-in users view others' workflow instances. Authenticated low-privilege atta…
DEFERRED
MEDIUM
5.0CVSS
CVE-2026-129356 · Nov 15, 2026
A vulnerability was found in vllm-project vllm 0.30.0/0.31.0. This vulnerability affects unknown code of the file single_type_kv_cache_manager.py of the component Common Prefix Handler. The manipulation results in race condition. The attack…
AWAITING ANALYSIS
MEDIUM
6.5CVSS
CVE-2026-129355 · Nov 15, 2026
A vulnerability has been found in sigoden dufs up to 0.46.0. This affects an unknown part of the file src/server.rs of the component WebDAV COPY Operation Handler. The manipulation leads to incorrect authorization. The attack is possible to…
DEFERRED
MEDIUM
10.0CVSS
CVE-2026-129354 · Nov 15, 2026
A flaw has been found in D-Link DIR-600L 2.17b02. Affected by this issue is the function hnap_main of the file htdocs/cgibin of the component HNAP Handler. Executing a manipulation can lead to stack-based buffer overflow. The attack can be …
DEFERRED
CRITICAL
10.0CVSS
CVE-2026-129353 · Nov 15, 2026
A vulnerability was detected in D-Link DIR-600L 2.17/2.17b02. Affected by this vulnerability is the function authenticationcgi_main of the file authentication.cgi. Performing a manipulation of the argument id/password results in stack-based…
DEFERRED
CRITICAL
9.1CVSS
CVE-2026-129352 · Nov 14, 2026
A vulnerability was detected in TRENDnet TEW-657BRM 1.00.1. This issue affects some unknown processing of the file /usr/sbin/upgrade_flash.cgi. Performing a manipulation of the argument boundary results in stack-based buffer overflow. The a…
DEFERRED
CRITICAL
10.0CVSS
CVE-2026-129351 · Nov 14, 2026
A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.1. This vulnerability affects the function sprintf of the file /setup.cgi of the component mini_httpd. Such manipulation leads to out-of-bounds write. The attack can be …
DEFERRED
CRITICAL
7.7CVSS
CVE-2026-129456 · Nov 14, 2026
In FRRouting, bgpd accepts a Tunnel Encapsulation attribute (type 23) whose outer TLV length does not match the length of the attribute: the mismatch is only logged and the attribute is processed anyway. A BGP neighbor can send UPDATE messa…
RECEIVED
HIGH
-CVSS
CVE-2015-10149 · Nov 14, 2026
Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine.
read_session_id returns the cookie value as the session id without checking its characters, and Dancer hands it to the sessi…
RECEIVED
NA
6.1CVSS
CVE-2026-129447 · Nov 14, 2026
Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows unauthenticated attackers to inject javascript: hyperlinks by supplying crafted DBML table url, headercolor, or TableGroup col…
RECEIVED
MEDIUM
3.5CVSS
CVE-2026-129267 · Nov 14, 2026
A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch th…
DEFERRED
LOW
5.5CVSS
CVE-2026-129264 · Nov 14, 2026
A security vulnerability has been detected in sox_ng up to 14.8.1. Affected by this issue is the function read_samples_voc of the file src/voc.c of the component VOC Decoder. Such manipulation leads to out-of-bounds write. The attack can be…
DEFERRED
MEDIUM
7.3CVSS
CVE-2026-129262 · Nov 14, 2026
A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected by this vulnerability is the function DiyFileUpload of the file /ws.asmx. This manipulati…
DEFERRED
HIGH
8.2CVSS
CVE-2026-129261 · Nov 14, 2026
A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.0. The impacted element is an unknown function in the library NTIOLib_X64.sys of the component IOCTL Handler. Performing a manipulation results in exposed ioc…
DEFERRED
HIGH
6.6CVSS
CVE-2026-129260 · Nov 14, 2026
A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.0. This vulnerability affects the function fs.readFileSync of the file local.provider.ts of the component Custom Page Handler. The manipulation of the argument path …
DEFERRED
MEDIUM
5.4CVSS
CVE-2026-127115 · Nov 14, 2026
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buddyforms_form_content' parameter in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes…
DEFERRED
MEDIUM
7.2CVSS
CVE-2026-120687 · Nov 14, 2026
The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'img alt attribute inside .wp-caption container' parameter in all versions up to, and including, 2.8.7 …
DEFERRED
HIGH
7.2CVSS
CVE-2026-116753 · Nov 14, 2026
The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart field name (array key)' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and …
DEFERRED
HIGH
6.4CVSS
CVE-2026-110531 · Nov 14, 2026
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter in all versions up to, and including, 8.1.9 due to insufficient input sanitization and output escaping. This makes it pos…
DEFERRED
MEDIUM
3.5CVSS
CVE-2026-129259 · Nov 14, 2026
A weakness has been identified in Mereithhh VanBlog up to 0.54.0. This affects an unknown part of the file packages/server/src/types/access/access.ts of the component Image Upload Endpoint. Executing a manipulation can lead to cross site sc…
DEFERRED
LOW
9.1CVSS
CVE-2026-129258 · Nov 14, 2026
A vulnerability was identified in Tenda AC18 15.03.05.05_multi/15.03.05.19 Build 6318. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/upgrade of the component Firmware Upgrade Handler. Such manipulation of t…
DEFERRED
CRITICAL
-CVSS
CVE-2011-10042 · Nov 14, 2026
HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached.
The session id from the client's cookie reaches memcached unchanged as the cache key.
A CR and LF…
RECEIVED
NA
9.8CVSS
CVE-2026-19907 · Nov 14, 2026
The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.0. This is due to the `authenticate_rest_user()` function parsing the `LOGGED_IN_COOKIE` value and authenticating the named user without verif…
DEFERRED
CRITICAL
8.8CVSS
CVE-2026-18053 · Nov 14, 2026
The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.7. This is due to a mass-assignment vulnerability in the `user_account_manager()` function's edit_profile branch, where all …
DEFERRED
HIGH
9.9CVSS
CVE-2026-129433 · Nov 14, 2026
Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows authenticated organization members to execute shell commands via the serviceName parameter. Attackers can store serviceName val…
DEFERRED
CRITICAL
6.5CVSS
CVE-2026-129432 · Nov 14, 2026
Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_mountd() in src/dissectors/ec_mountd.c that validates RPC credential and directory lengths independently rather than against the packet end. Network-adja…
RECEIVED
MEDIUM
6.5CVSS
CVE-2026-129431 · Nov 14, 2026
Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in src/dissectors/ec_socks.c that allows network-adjacent attackers to read heap memory via unchecked SOCKS5 username/password lengths. Attackers…
RECEIVED
MEDIUM
5.4CVSS
CVE-2026-129430 · Nov 14, 2026
Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script by storing raw HTML or javascript: Markdown links in bundle descriptions. Recipients viewing the public b…
RECEIVED
MEDIUM
7.1CVSS
CVE-2026-129429 · Nov 14, 2026
Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details, compute_tax_comparison and set_tax_regime methods of tax_regime_selector.py that allows authenticated low-privileged users to acc…
RECEIVED
HIGH
5.4CVSS
CVE-2026-129428 · Nov 14, 2026
Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that allows authenticated viewer-level users to manage approval requests. Attackers can list pending requests to expose propose…
RECEIVED
MEDIUM
8.8CVSS
CVE-2026-129255 · Nov 14, 2026
A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.6. This affects the function sub_11504 in the library WinRing0x64.sys of the component Device Driver. The manipulation of the argument PhysicalAddress leads to incorrect default…
DEFERRED
HIGH
4.3CVSS
CVE-2026-129254 · Nov 14, 2026
A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c. This impacts an unknown function of the file admin/TUI/index.php of the component Admin TUI. This manipulation of the argument img causes cross site scrip…
DEFERRED
MEDIUM