Vulnerabilities
Recent vulnerabilities
Recent vulnerabilities from
π GNA-1 (CIRCL)
Select from 85 available sources using the dropdown above.
Bitnami VulnDB is not individually searchable yet β the search will cover the sources available on the search page.
| ID | Description | Published | Updated |
|---|---|---|---|
| bit-python-2026-87910 | tarfile hardlink fallback ignores custom extraction filter rejection via None | 2026-09-17T11:54:23.295Z | 2026-10-05T12:12:53.169Z |
| bit-python-2026-82049 | tarfile extraction filters allow file modification and content disclosure via hard link to symlink | 2026-09-21T09:07:26.646Z | 2026-10-05T12:12:53.169Z |
| bit-python-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 2026-06-05T10:55:22.351Z | 2026-10-05T12:12:53.169Z |
| bit-python-2026-19672 | tarfile extraction filter bypass allows creation of directories outside the destination | 2026-08-25T12:57:48.991Z | 2026-10-05T12:12:53.169Z |
| bit-python-2026-17084 | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | 2026-09-11T05:56:25.239Z | 2026-10-05T12:12:53.169Z |
| bit-python-2026-15806 | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | 2026-09-11T05:56:23.900Z | 2026-10-05T12:12:53.169Z |
| bit-python-2026-15310 | zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits | 2026-09-11T05:56:22.537Z | 2026-10-05T12:12:53.169Z |
| bit-python-2026-12345 | Race condition in tempfile.TemporaryDirectory cleanup allows deleting files outside the temporary directory | 2026-10-05T11:56:26.851Z | 2026-10-05T12:12:53.169Z |
| bit-parse-2026-101042 | Parse Server 9.0.0 Authentication Bypass via Unverified Provider Identity | 2026-10-05T11:52:30.996Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102588 | Moodle: csrf in xml grade import | 2026-10-05T11:55:35.760Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102587 | Moodle: user list filters bypass profile field visibility | 2026-10-05T11:55:34.249Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102586 | Moodle: xss via password reset link due to insufficient username escaping | 2026-10-05T11:55:32.748Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102585 | Moodle: group validation missing when enrolling user to course | 2026-10-05T11:55:31.390Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102584 | Moodle: missing capability check allows unauthorised grade penalty recalculation | 2026-10-05T11:55:30.017Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102583 | Moodle: incorrect capability check in ai generate image web service | 2026-10-05T11:55:28.669Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102582 | Moodle: manual enrolment page accessible when plugin disabled | 2026-10-05T11:55:27.334Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102581 | Moodle: xss in forum post templates due to insufficient escaping | 2026-10-05T11:55:25.980Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102580 | Moodle: arbitrary class instantiation via report builder audience classname | 2026-10-05T11:55:24.688Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102579 | Moodle: user profile information disclosure via grade web service | 2026-10-05T11:55:23.387Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102578 | Moodle: sql injection in question bank web service | 2026-10-05T11:55:22.085Z | 2026-10-05T12:12:53.169Z |
| bit-moodle-2026-102577 | Moodle: ssrf risk in url downloader via ipv4-mapped ipv6 address bypass | 2026-10-05T11:55:20.779Z | 2026-10-05T12:12:53.169Z |
| bit-mlflow-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) | 2026-08-21T05:51:48.507Z | 2026-10-05T12:12:53.169Z |
| bit-mastodon-2025-67500 | Mastodon Error Handling Discrepancy Enables Private Status Existence Enumeration | 2025-12-11T11:41:16.693Z | 2026-10-05T12:12:53.169Z |
| bit-libpython-2026-87910 | tarfile hardlink fallback ignores custom extraction filter rejection via None | 2026-09-17T11:47:03.864Z | 2026-10-05T12:12:53.169Z |
| bit-libpython-2026-82049 | tarfile extraction filters allow file modification and content disclosure via hard link to symlink | 2026-09-21T09:00:11.991Z | 2026-10-05T12:12:53.169Z |
| bit-libpython-2026-7210 | The expat and elementtree parsers use insufficient entropy for XML hash-flooding protection | 2026-06-05T10:47:50.406Z | 2026-10-05T12:12:53.169Z |
| bit-libpython-2026-19672 | tarfile extraction filter bypass allows creation of directories outside the destination | 2026-08-25T12:53:36.732Z | 2026-10-05T12:12:53.169Z |
| bit-libpython-2026-17084 | stringprep.map_table_b2() deviates from RFC 3454 Table B.2 | 2026-09-11T05:48:23.581Z | 2026-10-05T12:12:53.169Z |
| bit-libpython-2026-15806 | `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching | 2026-09-11T05:48:22.080Z | 2026-10-05T12:12:53.169Z |
| bit-libpython-2026-15310 | zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limits | 2026-09-11T05:48:20.534Z | 2026-10-05T12:12:53.169Z |