Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
🏠GNA-1 (CIRCL)
Select from 82 available sources using the dropdown above.
| ID | Severity | Description | Published | Updated |
|---|---|---|---|---|
| ghsa-ph6c-2pxw-cvfg |
4.3 (3.1)
2.1 (4.0)
|
A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c… | 2026-09-10T00:30:28Z | 2026-09-10T00:30:28Z |
| ghsa-jp98-64m5-6c94 |
6.5 (3.1)
5.5 (4.0)
|
A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d… | 2026-09-10T00:30:28Z | 2026-09-10T00:30:28Z |
| ghsa-jgf4-gc7v-8wx2 |
7.3 (3.1)
5.5 (4.0)
|
A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5d… | 2026-09-10T00:30:28Z | 2026-09-10T00:30:28Z |
| ghsa-g6hw-3r4r-q8pw |
4.3 (3.1)
2.1 (4.0)
|
A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec… | 2026-09-10T00:30:28Z | 2026-09-10T00:30:28Z |
| ghsa-g437-q4fp-pq2g |
9.3 (4.0)
|
Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a… | 2026-09-10T00:30:28Z | 2026-09-10T00:30:28Z |
| ghsa-cc37-h9x3-vxxm |
9.6 (3.1)
8.6 (4.0)
|
A vulnerability has been found in Behavioral Technology Group Pavlok Behavioral Conditioning Wearab… | 2026-09-10T00:30:28Z | 2026-09-10T00:30:28Z |
| ghsa-6jp9-67v9-qq6p |
|
Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-s… | 2026-09-10T00:30:28Z | 2026-09-10T00:30:28Z |
| ghsa-wvvf-rj6j-5fcw |
|
yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS). The file upload endpoint /api/upload o… | 2026-09-10T00:30:27Z | 2026-09-10T00:30:27Z |
| ghsa-rv64-rv32-9xg6 |
|
In RuoYi-Cloud-Plus <= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskContro… | 2026-09-10T00:30:27Z | 2026-09-10T00:30:27Z |
| ghsa-jrpr-987w-vfxw |
|
zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equip… | 2026-09-10T00:30:27Z | 2026-09-10T00:30:27Z |
| ghsa-gvv2-7gf7-286x |
|
An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticate… | 2026-09-10T00:30:27Z | 2026-09-10T00:30:27Z |
| ghsa-93h7-x9h6-vfvp |
7.7 (3.1)
|
In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fo… | 2026-09-10T00:30:27Z | 2026-09-10T00:30:27Z |
| ghsa-7h85-frp3-m64f |
7.3 (3.1)
5.5 (4.0)
|
A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec… | 2026-09-10T00:30:27Z | 2026-09-10T00:30:27Z |
| ghsa-27rv-5mrj-28wh |
7.3 (3.1)
5.5 (4.0)
|
A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b… | 2026-09-10T00:30:27Z | 2026-09-10T00:30:27Z |
| ghsa-3cgp-3cqx-j8w2 |
6.5 (3.1)
|
Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree | 2026-09-09T23:54:22Z | 2026-09-09T23:54:22Z |
| ghsa-5x7x-4c3c-qf5w |
5.0 (3.1)
|
Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets | 2026-09-09T23:54:08Z | 2026-09-09T23:54:08Z |
| ghsa-jqhh-cjmq-vmv6 |
6.5 (3.1)
|
Open WebUI: Any authenticated user can hang the server via a cyclic chat message history | 2026-09-09T23:53:59Z | 2026-09-09T23:53:59Z |
| ghsa-cp3j-m783-3ph5 |
8.5 (3.1)
|
Identrail Cross-tenant IDOR: Client-supplied GitHub App installation_id is bound to the caller's wo… | 2026-09-09T23:52:14Z | 2026-09-09T23:52:14Z |
| ghsa-g72f-jw3w-mgh7 |
8.3 (3.1)
|
@openhop/server: Path Traversal in Flow ID File Operations | 2026-09-09T23:51:59Z | 2026-09-09T23:51:59Z |
| ghsa-vv4j-m4vr-f3g6 |
8.8 (3.1)
|
ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site b… | 2026-09-09T23:51:25Z | 2026-09-09T23:51:25Z |
| ghsa-wcjj-9m6g-2fr2 |
7.8 (3.1)
|
functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dy… | 2026-09-09T23:49:20Z | 2026-09-09T23:49:20Z |
| ghsa-m835-3cm9-rggg |
7.8 (3.1)
|
Joker linter executed project-local .jokerd/linter.* files during linting | 2026-09-09T23:48:46Z | 2026-09-09T23:48:46Z |
| ghsa-hxjg-93wc-h8p8 |
8.8 (3.1)
|
Komari: Management Interface CSRF | 2026-09-09T23:48:31Z | 2026-09-09T23:48:31Z |
| ghsa-2r5q-h53f-9rp3 |
8.8 (3.1)
|
@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run | 2026-09-09T23:47:55Z | 2026-09-09T23:47:55Z |
| ghsa-fxg7-897c-57mp |
7.5 (3.1)
|
Nuxt Ollama: Public Runtime Config Exposes Ollama API Key to Browser Clients | 2026-09-09T23:47:44Z | 2026-09-09T23:47:44Z |
| ghsa-v25g-mvwr-f5fp |
6.5 (3.1)
|
webhookd: Unrestricted HTTP Header to Shell Variable Injection | 2026-09-09T23:47:03Z | 2026-09-09T23:47:03Z |
| ghsa-5hx7-j24v-rffj |
7.7 (4.0)
|
GeoNetwork Web Module: Unauthenticaded Server-Side Request Forgery in SLD Tool | 2026-09-09T23:43:51Z | 2026-09-09T23:43:51Z |
| ghsa-xvj8-284g-wf2v |
|
An issue was discovered in s-pms SPMS-Server through v1.0. The application contains a hardcoded def… | 2026-09-09T21:31:57Z | 2026-09-09T21:31:57Z |
| ghsa-pxwm-vpxr-j323 |
|
An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically p… | 2026-09-09T21:31:57Z | 2026-09-09T21:31:57Z |
| ghsa-mgxg-c8rg-pvvr |
6.5 (3.1)
|
An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.… | 2026-09-09T21:31:57Z | 2026-09-09T21:31:57Z |