Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
56672
Total
4490
Critical
16802
High
16633
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-61589 | MEDIUM | 6.3 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via … | Sep 16, 2026 |
| CVE-2026-61588 | MEDIUM | 6.5 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, when a Django `Model` instance is assigned to a … | Sep 16, 2026 |
| CVE-2026-92599 | HIGH | 7.5 | joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One … | Sep 16, 2026 |
| CVE-2026-92598 | MEDIUM | 6.5 | Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant … | Sep 16, 2026 |
| CVE-2026-92597 | MEDIUM | 6.5 | Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately before a non-break character causes … | Sep 16, 2026 |
| CVE-2026-92596 | HIGH | 7.5 | Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a … | Sep 16, 2026 |
| CVE-2026-92595 | MEDIUM | 5.9 | Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options when message content is resolved through the public … | Sep 16, 2026 |
| CVE-2026-92594 | HIGH | 7.5 | Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of requiring the user-data scope enforced by Gql::canQueryUsers() (usergroups.*:read), … | Sep 16, 2026 |
| CVE-2026-92593 | HIGH | 8.8 | Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit added … | Sep 16, 2026 |
| CVE-2026-92592 | HIGH | 8.8 | Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate … | Sep 16, 2026 |
| CVE-2026-92591 | MEDIUM | 5.9 | Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer actions — including install/validate-site … | Sep 16, 2026 |
| CVE-2026-92590 | MEDIUM | 5.4 | Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to … | Sep 16, 2026 |
| CVE-2026-92589 | MEDIUM | 4.3 | Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control panel user … | Sep 16, 2026 |
| CVE-2026-92588 | MEDIUM | 4.4 | n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to … | Sep 16, 2026 |
| CVE-2026-92587 | MEDIUM | 5.0 | n8n is a workflow automation platform. In versions before 1.123.76, 2.37.7, and 2.38.2, the Git node validated a relative remote URL against the configured repositoryPath … | Sep 16, 2026 |
| CVE-2026-92586 | MEDIUM | 4.3 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted … | Sep 16, 2026 |
| CVE-2026-92585 | MEDIUM | 4.3 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted … | Sep 16, 2026 |
| CVE-2026-92584 | MEDIUM | 6.1 | AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint objects/videoAddViewCount.json.php reaches VideoStatistic::save(), which writes the caller's User-Agent (via … | Sep 16, 2026 |
| CVE-2026-92583 | MEDIUM | 6.5 | AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate … | Sep 16, 2026 |
| CVE-2026-92582 | HIGH | 7.1 | AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVideo's automatic CSRF guard ($global['skipAutoCSRFCheck']) and the untrusted-request check ($global['bypassSameDomainCheck']) merely … | Sep 16, 2026 |
| CVE-2026-92581 | MEDIUM | 4.3 | In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers … | Sep 16, 2026 |
| CVE-2026-92580 | HIGH | 8.8 | In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~270) the stored SSH password is substituted into … | Sep 16, 2026 |
| CVE-2026-92579 | MEDIUM | 5.4 | In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to … | Sep 16, 2026 |
| CVE-2026-92578 | HIGH | 8.1 | WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code … | Sep 16, 2026 |
| CVE-2026-92577 | HIGH | 7.5 | In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos with owner PII … | Sep 16, 2026 |