Vulnerability-Lookup - Race Condition in Account Recovery Token Consumption Allows Password Takeover

Published 2026-09-27 by CIRCL

KitchenOwl through 0.7.10 IDOR via unchecked category ID

Published 2026-09-27 by VulnCheck

navi through 2.24.0 OS Command Injection via Cheatsheet Variables

Published 2026-09-27 by VulnCheck

Sylius 2.x before 2.1.16 and 2.2.9 Payment Amount Overwrite

Published 2026-09-27 by VulnCheck

Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 JWT Audience Confusion Allows Admin API Authentication

Published 2026-09-27 by VulnCheck

Sylius before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 Admin Password Reset Poisoning via Host Header

Published 2026-09-27 by VulnCheck

Sylius 2.x before 2.1.16 and 2.2.9 Arbitrary Payment Action via Shop API

Published 2026-09-27 by VulnCheck

Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge

Published 2026-09-27 by VulnCheck

spaceship-prompt through 4.22.5 Terminal Escape Sequence Injection

Published 2026-09-27 by VulnCheck

onefetch through 2.28.1 Terminal Escape Sequence Injection

Published 2026-09-27 by VulnCheck

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

Published 2026-09-27 by Joomla

Joomla Extension - svenbluege.de - Path Traversal in Clear Cache task in Event Gallery extension < 6.5.0

Published 2026-09-27 by Joomla

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0

Published 2026-09-27 by Joomla

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0

Published 2026-09-27 by Joomla

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0

Published 2026-09-27 by Joomla

Heap use-after-free on read during bidirectional (D)TLS shutdown

Published 2026-09-27 by wolfSSL

OCSP stapling v2 multi accepts non-CA chain certificates as issuers

Published 2026-09-27 by wolfSSL

NameConstraints not enforced across unconstrained intermediate CA

Published 2026-09-27 by wolfSSL

Subject CN name-constraint check bypassed when non-DNS SAN present

Published 2026-09-27 by wolfSSL

Failed X509_verify_cert leaves unverified CA in shared CertManager

Published 2026-09-27 by wolfSSL

Client accepts unsolicited RawPublicKey server certificate type

Published 2026-09-27 by wolfSSL

Trusted peer certificate match ignores public key, allowing forged CA clones

Published 2026-09-27 by wolfSSL

(D)TLS 1.2 client accepts early ChangeCipherSpec before ClientKeyExchange

Published 2026-09-27 by wolfSSL

CRL check skipped when OCSP enabled and certificate has no OCSP URL

Published 2026-09-27 by wolfSSL

Signature failure masked by date error under WOLFSSL_SMALL_CERT_VERIFY

Published 2026-09-27 by wolfSSL

Client session cache reference poisoning allows resumption with wrong server

Published 2026-09-27 by wolfSSL

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer

Published 2026-09-27 by GitLab

PowerPress < 11.17.2 - Contributor+ Stored XSS via Podcast Player Block

Published 2026-09-27 by WPScan

NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion

Published 2026-09-27 by WPScan

Optima Express 8.6.0 - 8.7.5 - Author+ Stored XSS via faq_script

Published 2026-09-27 by WPScan

Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache

Published 2026-09-27 by WPScan

Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request

Published 2026-09-27 by WPScan

WP YouTube Lyte < 1.7.31 - Contributor+ Stored XSS via Embed Block Attributes

Published 2026-09-27 by WPScan

Verge3D <= 4.13.0 - Unauthenticated Product Download Disclosure via v3d_download_file

Published 2026-09-27 by WPScan

Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR

Published 2026-09-27 by WPScan

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Stored XSS via Feed Import

Published 2026-09-27 by WPScan

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Preview

Published 2026-09-27 by WPScan

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ Post Publication and Author Spoofing via Campaign Settings

Published 2026-09-27 by WPScan

WPeMatico RSS Feed Fetcher < 2.8.27 - Contributor+ SSRF via Campaign Run

Published 2026-09-27 by WPScan

Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

Published 2026-09-27 by WPScan

Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR

Published 2026-09-27 by WPScan

Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription

Published 2026-09-27 by WPScan

EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes

Published 2026-09-27 by WPScan

UpdraftPlus 1.23.8 - 1.26.7 - Subscriber+ Remote Storage Credential Disclosure via Migration Notice

Published 2026-09-27 by WPScan

Ad Inserter 2.8.12 - 2.8.18 - Subscriber+ RCE / Stored XSS via Global Custom Fields

Published 2026-09-27 by WPScan

WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

Published 2026-09-27 by WPScan

coollabsio Coolify GitHub App Setup redirect missing authentication

Published 2026-09-27 by VulDB

Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow

Published 2026-09-27 by VulDB

Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching

Published 2026-09-27 by VulnCheck

Edgeless Systems Contrast through 1.20.0 Denial of Service via ciphertextContainer

Published 2026-09-27 by VulnCheck

Heym before 0.0.53 Multiple RCE and Authentication Bypass Vulnerabilities

Published 2026-09-27 by VulnCheck

heym before 0.0.91 Remote Code Execution via Expression Engine

Published 2026-09-27 by VulnCheck

Heym before 0.0.91 SSRF via image fetching and IPv6 validation

Published 2026-09-27 by VulnCheck

heym before 0.0.91 Multiple Secrets Plaintext Storage

Published 2026-09-27 by VulnCheck

heym before 0.0.105 SSRF via credential-controlled base URLs

Published 2026-09-27 by VulnCheck

heym before 0.0.105 Authentication Bypass via Redis Node

Published 2026-09-27 by VulnCheck

Heym before 0.0.106 Credential Exfiltration via URL Override

Published 2026-09-27 by VulnCheck

heym before 0.0.109 Server-Side Request Forgery via Workflow Nodes

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.4 Remote Code Execution via Liquidsoap string interpolation

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.6 Code Injection via Remote Relay Password

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.6 Missing Permission Check via /play

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.6 Metadata Injection via Liquidsoap API

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass

Published 2026-09-27 by VulnCheck

AzuraCast through 0.23.x Command Injection via Streamer Username

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.8 Broken Access Control via GET /api/station/{id}/vue/profile

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.8 SSRF and Local File Read via Remote Playlist

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.8 SSRF Filter Bypass via Hostname and Private IPs

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.8 Server-Side Request Forgery via Remote Relay URL

Published 2026-09-27 by VulnCheck

AzuraCast before 0.23.8 DQL Injection via sortOrder

Published 2026-09-27 by VulnCheck

MONAI before 1.5.2 Remote Code Execution via Pickle Deserialization

Published 2026-09-27 by VulnCheck

MONAI before 1.6.0 Remote Code Execution via NumpyReader

Published 2026-09-27 by VulnCheck

MONAI before 1.6.0 OS Command Injection via dataset_name_or_id

Published 2026-09-27 by VulnCheck

MONAI before 1.6.0 Remote Code Execution via algo_from_pickle

Published 2026-09-27 by VulnCheck

MONAI through 1.6.0 _get_fake_spatial_shape eval() Sandbox Bypass via Attribute Chains

Published 2026-09-27 by VulnCheck

MONAI 1.6.0 PersistentDataset Remote Code Execution via Pickle Cache

Published 2026-09-27 by VulnCheck

MONAI through 1.6.0 Remote Code Execution via bundle configuration

Published 2026-09-27 by VulnCheck

Contrast before 1.18.0 AML Injection Remote Code Execution

Published 2026-09-27 by VulnCheck

Contrast before 1.19.1 CopyFile Policy Symlink Subversion

Published 2026-09-27 by VulnCheck

Contrast before 1.16.0 Remote Attestation Relay Attack

Published 2026-09-27 by VulnCheck

http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass

Published 2026-09-27 by VulnCheck

Contrast before 1.23.1 Image Substitution via Policy Generation

Published 2026-09-27 by VulnCheck

http4k before 6.48.0.0 Cookie Scoping Bypass via BasicCookieStorage

Published 2026-09-27 by VulnCheck

http4k before 6.49.0.0 Host Header Routing Bypass via reverseProxy

Published 2026-09-27 by VulnCheck

vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

Published 2026-09-27 by VulnCheck

vm2 before 3.12.2 Host Process Termination via Construct Trap

Published 2026-09-27 by VulnCheck

vm2 before 3.12.2 Authorization Bypass via Custom Resolver

Published 2026-09-27 by VulnCheck

Contrast before 1.4.1 Coordinator Impersonation via Unauthenticated Recovery

Published 2026-09-27 by VulnCheck

Contrast before 1.8.1 Information Disclosure via Logging

Published 2026-09-27 by VulnCheck

Edgeless Systems Contrast before 1.9.1 Insecure Volume Mount

Published 2026-09-27 by VulnCheck

Edgelesssys Contrast before 1.12.2 Workload Secrets Information Disclosure

Published 2026-09-27 by VulnCheck

Contrast before 1.12.1 Insecure LUKS2 Persistent Storage

Published 2026-09-27 by VulnCheck

coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization

Published 2026-09-27 by VulDB

D-Link DIR-895L L2TP Control Channel tunnel.c tunnel_set_params out-of-bounds write

Published 2026-09-27 by VulDB

mathurvishal CloudClassroom-PHP-Project viewresult.php sql injection

Published 2026-09-26 by VulDB

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Published 2026-09-26 by elastic

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Published 2026-09-26 by elastic

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Published 2026-09-26 by elastic

Uncontrolled Resource Consumption in Kibana Leading to denial of service

Published 2026-09-26 by elastic

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Published 2026-09-26 by elastic

Uncontrolled Resource Consumption in Elasticsearch Leading to denial of service

Published 2026-09-26 by elastic

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Published 2026-09-26 by elastic

Uncontrolled Resource Consumption in Elasticsearch Leading to Denial of Service

Published 2026-09-26 by elastic

Missing Authorization in Kibana Leading to Unauthorized Deletion of Data

Published 2026-09-26 by elastic

Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Published 2026-09-26 by elastic

Unintended Proxy or Intermediary ('Confused Deputy') in Kibana Leading to Privilege Escalation

Published 2026-09-26 by elastic

Ultra Addons for Contact Form 7 <= 3.5.50 - Unauthenticated Arbitrary File Upload via Signature Form Field

Published 2026-09-26 by Wordfence

Groups <= 4.6.0 - Authenticated (Subscriber+) Privilege Escalation via 'groups_join' Shortcode

Published 2026-09-26 by Wordfence

miniOrange OTP Login, Verification and SMS Notifications <= 5.5.5 - Unauthenticated Authentication Bypass via 'mo_wp_login_intent' Parameter

Published 2026-09-26 by Wordfence

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Published 2026-09-26 by Joomla

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Published 2026-09-26 by Joomla

Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Published 2026-09-26 by Joomla

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

Published 2026-09-26 by Joomla

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

Published 2026-09-26 by Joomla

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Published 2026-09-26 by Joomla

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3

Published 2026-09-26 by Joomla

capgo through 12.128.2 IDOR via PUT /app icon endpoint

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.12 Stored XSS via SSL certificate issuer

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.12 Credential Disclosure via DirProtections API

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.12 Authentication Bypass via EmailSender.add

Published 2026-09-26 by VulnCheck

froxlor before 2.3.12 CRLF Injection via validateUrl userinfo

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.12 Privilege Escalation via Symlink

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.12 Arbitrary File Deletion via Symlink

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.12 Command Injection via letsencryptchallengepath

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.12 Privilege Escalation via SSH Key Sync

Published 2026-09-26 by VulnCheck

froxlor before 2.3.12 Two-Factor Authentication Bypass via CSRF

Published 2026-09-26 by VulnCheck

froxlor before 2.3.12 Authentication Bypass via Session Persistence

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.12 DKIM Private Key Disclosure via API

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.12 2FA Bypass via Namespace Confusion

Published 2026-09-26 by VulnCheck

Froxlor before 2.3.13 Private Key Disclosure via Certificates API

Published 2026-09-26 by VulnCheck

Kyverno before 1.19.1 Namespace Isolation Bypass via Percent-Encoded Path

Published 2026-09-26 by VulnCheck

kyverno before 1.19.1 Privilege Escalation via Policy apiCall urlPath

Published 2026-09-26 by VulnCheck

Kyverno before 1.19.1 SSRF via legacy apiCall service executor

Published 2026-09-26 by VulnCheck

Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass

Published 2026-09-26 by VulnCheck

Kyverno before 1.19.1 Cross-Namespace Data Access via globalcontext.Lib

Published 2026-09-26 by VulnCheck

Nodemailer before 10.0.2 Stack Exhaustion via Nested Recipient Arrays

Published 2026-09-26 by VulnCheck

Nodemailer 5.0.0 through 10.0.1 TLS servername Cache Confusion

Published 2026-09-26 by VulnCheck

nodemailer before 10.0.6 Denial of Service via addressparser

Published 2026-09-26 by VulnCheck

Nodemailer before 10.0.9 Malformed Envelope Recipient via RFC 5322 Comment

Published 2026-09-26 by VulnCheck

Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex

Published 2026-09-26 by VulnCheck

Adminer 6.0.0 Server-Side Request Forgery via ClickHouse driver

Published 2026-09-26 by VulnCheck

Adminer before 6.0.2 Unauthenticated SSRF via Elasticsearch Driver

Published 2026-09-26 by VulnCheck

Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE

Published 2026-09-26 by VulnCheck

Hugo before 0.166.0 Cross-Site Scripting via text/org

Published 2026-09-26 by VulnCheck

Hugo v0.162.0 before v0.166.0 IP-literal Deny Rule Bypass

Published 2026-09-26 by VulnCheck

Hugo before v0.166.0 Path Traversal via Symlinked Mount Roots

Published 2026-09-26 by VulnCheck

Hugo before 0.166.0 Stored XSS via lineAnchors code block option

Published 2026-09-26 by VulnCheck

Hugo v0.161.0 to v0.165.0 Arbitrary File Read via Symlinks

Published 2026-09-26 by VulnCheck

GitPython before 3.1.62 Path Traversal via gitmodules path

Published 2026-09-26 by VulnCheck

Budibase server before 3.45.0 Cross-Tenant Information Disclosure

Published 2026-09-26 by VulnCheck

Budibase Server before 3.45.0 Credential Exposure via External Table Broadcast

Published 2026-09-26 by VulnCheck

Budibase before 3.45.0 Cross-Workspace Privilege Escalation via POST /api/global/groups/:groupId/apps

Published 2026-09-26 by VulnCheck

Budibase before 3.45.0 Information Disclosure via Chat Links

Published 2026-09-26 by VulnCheck

Budibase Server 3.41.0 before 3.45.0 Authentication Bypass via OIDC

Published 2026-09-26 by VulnCheck

Budibase before 3.45.0 SQL Injection via column-rename DDL

Published 2026-09-26 by VulnCheck

Budibase Server before 3.45.0 Arbitrary File Write via ZIP Symlink

Published 2026-09-26 by VulnCheck

Budibase before 3.45.0 SSRF and OAuth Token Exfiltration via Teams Webhook

Published 2026-09-26 by VulnCheck

Budibase before 3.45.0 Arbitrary Local File Read via OpenAPI Import

Published 2026-09-26 by VulnCheck

stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket

Published 2026-09-26 by VulnCheck

stoatchat before 0.15.5 MFA Brute Force via Insufficient Rate Limiting

Published 2026-09-26 by VulnCheck

stoatchat before 0.15.5 Account Enumeration via Error Location

Published 2026-09-26 by VulnCheck

stoatchat before 0.15.5 Local Filesystem Read via SVG

Published 2026-09-26 by VulnCheck

stoatchat before 0.15.5 Denial of Service via mass mentions

Published 2026-09-26 by VulnCheck

stoatchat before 0.15.5 Username Validation Bypass via Unicode Sanitization

Published 2026-09-26 by VulnCheck

Grav Data Manager before 1.4.5 Stored XSS via item-detail view

Published 2026-09-26 by VulnCheck

grav-plugin-comments before 1.2.11 Unauthenticated Information Disclosure

Published 2026-09-26 by VulnCheck

Grav before 2.0.25 Session Cookie Theft via Twig Sandbox

Published 2026-09-26 by VulnCheck

Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass

Published 2026-09-26 by VulnCheck

Grav before 2.0.25 Sensitive File Disclosure via Case-Variation Bypass

Published 2026-09-26 by VulnCheck

Grav before 2.0.25 Sandbox Escape via array Filter

Published 2026-09-26 by VulnCheck

grav-plugin-login 3.8.7 through 3.9.6 Two-Factor Authentication Bypass

Published 2026-09-26 by VulnCheck

Netty 4.2.0 through 4.2.17 Response Desynchronization via HttpServerCodec

Published 2026-09-26 by VulnCheck

Netty 4.2.11 through 4.2.17 QUIC Hostname Verification Bypass

Published 2026-09-26 by VulnCheck

Netty 4.2.2 through 4.2.15 HTTP/1 Host Header Authority Confusion

Published 2026-09-26 by VulnCheck

Netty HTTP/1 CONNECT authority-form mistranslated to malformed HTTP/3

Published 2026-09-26 by VulnCheck

Netty HTTP/3 QPACK encoder-stream unbounded memory exhaustion DoS

Published 2026-09-26 by VulnCheck

Netty HTTP/3 QPACK Prefixed Integer DoS via Unbounded Accumulation

Published 2026-09-26 by VulnCheck

Netty before 4.2.18.Final QpackEncoder Unbounded Memory Retention

Published 2026-09-26 by VulnCheck

Netty 4.2.0 through 4.2.18 HTTP/3 Request Routing Bypass

Published 2026-09-26 by VulnCheck

Netty before 4.1.138.Final Denial of Service via WebSocketServerExtensionHandler

Published 2026-09-26 by VulnCheck

Netty before 4.1.138.Final ByteBuf Leak in StompSubframeDecoder

Published 2026-09-26 by VulnCheck

Netty HttpServerCodec Unbounded Queue Growth via HTTP/1.1 Pipelining

Published 2026-09-26 by VulnCheck

Netty before 4.1.138.Final Denial of Service via SpdySessionHandler

Published 2026-09-26 by VulnCheck

vLLM before 0.29.0 Denial of Service via out-of-range stop_token_ids

Published 2026-09-26 by VulnCheck

vLLM 0.22.1 before 0.28.0 Incomplete Artifact Pin Propagation

Published 2026-09-26 by VulnCheck

vLLM 0.22.0 through 0.23.0 Denial of Service via stop_token_ids

Published 2026-09-26 by VulnCheck

vllm before 0.29.0 Denial of Service via Decoder Prompt Length Bypass

Published 2026-09-26 by VulnCheck

vLLM before 0.29.0 Resource Exhaustion via Unbounded Media Materialization

Published 2026-09-26 by VulnCheck

vLLM before 0.29.0 Resource Limit Bypass via Sampler Subclass

Published 2026-09-26 by VulnCheck

vllm before 0.29.0 Uncontrolled Resource Consumption via Audio Decoding

Published 2026-09-26 by VulnCheck

vLLM before 0.29.0 CPU Exhaustion via unbounded cache_salt

Published 2026-09-26 by VulnCheck