Vulnerabilidades

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients (node-fetch, axios) instead of using the secured wrapper. These tools include (1) OpenAPIToolkit/OpenAPIToolkit.ts, (2)…

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to 5.1.3, the MCP HTTP transport accepts JSON-RPC tools/call requests with no authentication, session, origin, or token check, and dispatches them directly to the orchestrator's tool registry. The default bind address is 0.0.0.0. As a result, any party…

Taiga is a project management platform for startups and agile developers. Prior 6.9.1, Taiga front is vulnerable to stored XSS. This vulnerability is fixed in 6.9.1.

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, the Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections. This vulnerability is fixed in…

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once coped, they'd be able to view its contents, and potentially publish it. Permissions were…

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they…

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information. This vulnerability is fixed in 7.0.7, 7.3.2, and 7.4.

Wagtail is an open source content management system built on Django. Prior to 7.0.7, 7.3.2, and 7.4, a CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive…

The OpenSearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users…

The Elasticsearch logging provider, when configured with a `host` URL that embeds credentials (for example `https://user:password@server.example.com:9200`), wrote the full host URL — including the embedded credentials — into task logs. Any user with task-log read permission could harvest the backend credentials. Users…

El plugin de WordPress Curtain 1.0.2 contiene una vulnerabilidad de falsificación de petición en sitios cruzados que permite a los atacantes activar o desactivar el modo de mantenimiento del sitio mediante la creación de peticiones maliciosas. Los atacantes pueden engañar a administradores autenticados para que envíen…

El Plugin GetPaid de WordPress 2.4.6 contiene una vulnerabilidad de inyección HTML que permite a atacantes autenticados inyectar código HTML arbitrario explotando el campo 'Help Text' en los formularios de pago. Los atacantes pueden inyectar HTML malicioso, incluyendo etiquetas de imagen y scripts, en el campo 'Help…

Contact Form to Email 1.3.24 contiene una vulnerabilidad de cross-site scripting almacenado que permite a atacantes autenticados inyectar scripts maliciosos al crear formularios con etiquetas de script en el campo de nombre del formulario. Los atacantes pueden elaborar nombres de formulario que contienen código…

apko permite a los usuarios construir y publicar imágenes de contenedor OCI construidas a partir de paquetes apk. Antes de la versión 1.2.7, DiscoverKeys en pkg/apk/apk/implementation.go afirma el tipo de las claves JWKS incondicionalmente como rsa.PublicKey sin verificar el tipo de clave. Si un endpoint JWKS de…

apko permite a los usuarios construir y publicar imágenes de contenedor OCI construidas a partir de paquetes apk. Antes de la versión 1.2.7, apko verifica la firma en APKINDEX.tar.gz pero nunca compara los paquetes .apk descargados individualmente con la suma de verificación registrada en el índice firmado. La suma de…

apko permite a los usuarios construir y publicar imágenes de contenedor OCI creadas a partir de paquetes apk. Desde la versión 0.14.8 hasta antes de la versión 1.2.5, un .apk manipulado podría instalar una entrada tar TypeSymlink cuyo objetivo apuntaba fuera de la raíz de construcción, y una entrada posterior de…

Plainpad es una aplicación autoalojada para tomar notas. Antes de la versión 1.1.1, Plainpad permite a un usuario autenticado con bajos privilegios autoescalar a administrador al enviar admin=true en PUT /API.PHP/v1/users/{id}. El endpoint persiste directamente el atributo admin de la entrada del usuario, y la cuenta…

La implementación de MilvusVectorStore#doDelete(List) de Spring AI es vulnerable a la inyección de expresiones de filtro a través de IDs de documentos no saneados. Spring AI 1.0.x: afectado desde 1.0.0 hasta la última versión 1.0.x; actualice a 1.0.7 o superior. Spring AI 1.1.x: afectado desde 1.1.0 hasta la última…

MailEnable Enterprise Premium 10.55 and earlier contains an improper authorization vulnerability in the WebAdmin mobile portal that allows attackers to bypass authentication checks by reusing AuthenticationToken cookies generated for low-privileged users. Attackers can obtain a token from the WebMail login endpoint…

SmarterTools SmarterMail builds prior to 9560 contain a local file inclusion vulnerability in the /api/v1/report/summary/{type} API endpoint that allows authenticated users to read arbitrary .json files on the system. Attackers can exploit this vulnerability combined with weak encryption algorithms and hardcoded keys…

Akamai Guardicore Platform Agent (GPA) and Zero Trust Client on Linux and macOS allow TOCTOU-based local privilege escalation. The GPA service creates an IPC socket in the world-writable /tmp directory. It accepts unauthenticated IPC control messages. This enables a TOCTOU vulnerability in the HandleSaveLogs()…

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.4.0, prior to zebra-chain version 7.0.0, and prior to zebra-network version 6.0.0, several inbound deserialization paths in Zebra allocated buffers sized against generic transport or block-size ceilings before the tighter protocol or consensus…

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad version 4.3.1 and prior to zebra-chain version 6.0.2, Orchard transactions contain a rk field which is a randomized validating key and also an elliptic curve point. The Zcash specification allows the field to be the identity (a "zero" value), however, the…

SEPPmail Secure Email Gateway before version 15.0.4 exposes server environment variables through an unauthenticated endpoint in the new GINA UI, allowing remote attackers to obtain sensitive system information.