Security Advisories

High CVE Reserved Tab Hijacking in Todoist for Chrome: One postMessage to Anywhere Todoist Todoist for Chrome <= 12.21.3 May 2026 — CVSS Critical CVE-2026-5758 Prototype Pollution via .proto: When Your Schema Poisons the Runtime protocol-buffers-schema protocol-buffers-schema < 3.6.1 Apr 2026 — CVSS Critical CVE-2026-2265 Replican't: When Deserialization Starts Writing Your Script Replicator Replicator <= 1.0.5 Mar 2026 — CVSS High CVE-2026-30952 LiquidOverflow — How a Template Engine Exposed 86,000 Repositories to Arbitrary File Read LiquidJS LiquidJS < 10.25.0 Mar 2026 8.7 CVSS High CVE-2026-24051 i0Regret: Breaking the Chain — How a Missing Slash Led to Arbitrary Code Execution OpenTelemetry OpenTelemetry-Go SDK < v1.40.0 Feb 2026 8.8 CVSS Medium CVE-2025-46389 Unverified Password Change Emby Emby MediaBrowser version 4.9.0.35 Jul 2025 6.5 CVSS Medium CVE-2025-46388 IDOR Exposing User Configurations and Pin Codes Emby Emby MediaBrowser version 4.9.0.35 Jul 2025 4.3 CVSS High CVE-2025-46390 User Enumeration via Registration Response Discrepancy Emby Emby MediaBrowser version 4.9.0.35 Jul 2025 7.5 CVSS Medium CVE-2025-46391 Session Token Exposed in URL Emby Emby MediaBrowser version 4.9.0.35 Jul 2025 6.5 CVSS High CVE-2025-46387 Privilege Escalation to Admin via Response Manipulation Emby Emby MediaBrowser version 4.9.0.35 Jul 2025 8.8 CVSS High CVE-2025-46386 Account Takeover via IDOR Pin Code Exposure Emby Emby MediaBrowser version 4.9.0.35 Jul 2025 8.8 CVSS Medium CVE-2025-23182 User Enumeration via Password Reset UBtech UBtech Freepass version 1.3.1807.1500 May 2025 4.3 CVSS Medium CVE-2025-23183 Open Redirect via Referer Header Manipulation UBtech UBtech Freepass version 1.3.1807.1500 May 2025 6.1 CVSS High CVE-2024-47921 Weak Crypto in Smadar SPS Smadar Smadar SPS version 4.0.44.0.64 Dec 2024 8.4 CVSS High CVE-2024-47917 Cross-Site Scripting (XSS) Mobotix Mobotix CCTV FW version MX-V3.4.2.16 Dec 2024 7.5 CVSS High CVE-2024-45253 Path Traversal via GET Request Avigilon Avigilon VideoIQ iCVR HD camera Nov 2024 7.5 CVSS Medium CVE-2024-45247 Open Redirect via returnUrl Parameter Sonarr Sonarr before version 4.0.9.2244 Oct 2024 TBD CVSS Critical CVE-2024-45251 / CVE-2024-45252 They Fixed It. We Broke It Again. Elsight Elsight Halo version 11.7.1.5 Oct 2024 9.8 CVSS High CVE-2024-42343 User Enumeration via Login Response Discrepancy Loway Loway QueueMetrics 17.06.1 - 22.02.11 Sep 2024 7.5 CVSS Medium CVE-2024-42341 Open Redirect via AUTH_url Parameter Loway Loway QueueMetrics 22.11.6 Sep 2024 6.1 CVSS Medium CVE-2024-42342 Host Header Override via HTTP Request Smuggling Loway Loway QueueMetrics 22.11.6 Sep 2024 4.3 CVSS Medium CVE-2024-42338 Full User List Exposure via Search Filter Bypass CyberArk CyberArk Identity Management Aug 2024 4.3 CVSS High CVE-2024-42340 Privilege Escalation via Client-Side Response Manipulation CyberArk CyberArk Identity Management Aug 2024 8.3 CVSS Medium CVE-2024-42339 IDOR Exposing Other Users' Rules and Configurations CyberArk CyberArk Identity Management Aug 2024 4.3 CVSS Medium CVE-2024-42337 Exposure of Complete Client List to Any User CyberArk CyberArk Identity Management Aug 2024 6.5 CVSS Medium CVE-2024-41694 Exposure of Complete User List Cybonet PineApp Mail Relay Jul 2024 5.3 CVSS High CVE-2024-41695 Unauthenticated Local File Inclusion via Base64 Encoded Path Cybonet PineApp Mail Relay Jul 2024 7.5 CVSS Critical CVE-2023-42495 Command Injection via Login Username Field Dasan Networks Dasan Networks W-Web versions 1.22-1.27 Dec 2023 9.8 CVSS Medium CVE-2023-37217 User Enumeration via Account Lockout Behavior Tadiran Telecom Tadiran Telecom Aeonix Jul 2023 5.3 CVSS High CVE-2023-37218 Local File Inclusion via fileName Parameter Tadiran Telecom Tadiran Telecom Aeonix Jul 2023 7.5 CVSS Medium CVE-2023-31186 User Enumeration via Registration Avaya Avaya IX Workforce Engagement v15.2.7.1195 May 2023 5.3 CVSS Medium CVE-2023-32218 Open Redirect via rd Parameter Avaya Avaya IX Workforce Engagement v15.2.7.1195 May 2023 6.1 CVSS Medium CVE-2023-31187 Credentials Exposed in Developer Tools Avaya Avaya IX Workforce Engagement v15.2.7.1195 May 2023 6.5 CVSS Medium CVE-2023-23458 Full Credential Exposure Leading to Account Takeover Sunell Sunell DVR Jan 2023 6.5 CVSS High CVE-2023-23466 Unverified Password Change MediaCP Media CP Media Control Panel Jan 2023 7.5 CVSS High CVE-2023-23467 Reflected XSS in Multiple Parameters MediaCP Media CP Media Control Panel Jan 2023 8.1 CVSS High CVE-2023-23464 Flash Cross-Domain Policy Misconfiguration MediaCP Media CP Media Control Panel Jan 2023 8.1 CVSS Critical CVE-2023-23465 Cross-Site Request Forgery (CSRF) MediaCP Media CP Media Control Panel Jan 2023 9.1 CVSS Medium CVE-2022-39181 Reflected Cross-Site Scripting (XSS) GLPI GLPI Reports Plugin Nov 2022 TBD CVSS Critical CVE-2022-36787 SQL Injection via DocNumber Parameter WebVendome WebVendome Nov 2022 9.8 CVSS Medium CVE-2022-39178 Internal Server IP Disclosure WebVendome WebVendome Nov 2022 5.3 CVSS Critical CVE-2022-36784 Grounded by Default — How Default Credentials Gave Us Root on Military Drone Comms Elsight Elsight Halo Chipset Oct 2022 9.8 CVSS Medium CVE-2022-36778 Blind Stored XSS via Document Comments Synel Synel eHarmony Aug 2022 6.5 CVSS High CVE-2022-23169 Error-Based SQL Injection Amodat Amodat Mobile Application Gateway Jun 2022 7.2 CVSS Critical CVE-2022-23168 SQL Injection Authentication Bypass Amodat Amodat Mobile Application Gateway Jun 2022 9.8 CVSS Critical CVE-2022-23167 Local File Inclusion Amodat Amodat Mobile Application Gateway Jun 2022 9.8 CVSS Medium CVE-2022-22797 Open Redirect via redirectURL Parameter SysAid SysAid May 2022 6.1 CVSS Critical CVE-2022-22796 Unauthenticated Account Takeover via Setup Wizard Abuse SysAid SysAid May 2022 9.8 CVSS Medium CVE-2022-22791 Blind Stored XSS via Nickname Field Synel Synel eHarmony version 8.0.2.3 Jan 2022 6.1 CVSS Medium CVE-2021-36720 Reflected XSS via url Parameter Cybonet Cybonet PineApp Mail Secure Nov 2021 6.1 CVSS