CVE Vulnerability Catalog

Stored Cross-Site Scripting (XSS) vulnerability in the YouTubeAPI plugin of AVideo (versions 29.0 and below). An attacker can inject malicious JavaScript by setting a YouTube video title, which is then rendered on the AVideo homepage without HTML encoding.

AVideo prior to version 29.0 contains an unauthenticated Reflected XSS vulnerability in YouTubeAPI Gallery Pagination. The $_GET['search'] parameter is concatenated directly into the href attribute of pagination links without proper encoding, allowing arbitrary JavaScript injection.

Dulwich through version 1.1.0 is missing SSH host key verification in contrib/paramiko_vendor.py. This means that during SSH connections, the server's public key is not checked for trustworthiness.

Heap overflow in the ifsbreakup() function (shell/ash.c) of Busybox v1.38.0. An attacker can cause a Denial of Service (DoS) by supplying crafted input.

A Cross Site Scripting (XSS) vulnerability has been discovered in xxl-job-admin version 3.0.0. A remote attacker can exploit a crafted HTTP GET request containing a malicious script to execute arbitrary code in the victim's browser context.

Listmonk prior to version 6.2.0 contains an SQL injection vulnerability in the GET /api/subscribers/export endpoint. The user-controlled query parameter is passed to QuerySubscribersForExport without validation, allowing an authenticated user with appropriate permissions to read arbitrary database tables and execute data-modifying PostgreSQL CTEs.

In 9Router prior to version 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header.

In n8n-MCP prior to version 2.57.4, multi-tenant HTTP mode with ENABLE_MULTI_TENANT=true could allow an authenticated tenant to access default-scope workflow_versions backups instead of being confined to the tenant scope, exposing or deleting workflow-version backups from prior single-tenant deployments or migrations.

A vulnerability in NocoBase prior to version 2.1.19 allowed command injection during PostgreSQL backup restoration. An attacker with backup management privileges could inject malicious values into the database.schema field in _metadata.json, which was then interpolated into a shell command executed via child_process.exec().

CVE-2026-55399 is a resource exhaustion vulnerability in Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can create a non-persistent DoS against the publisher.

In NocoBase version 2.0.59 and earlier, the checkSQL() function in the collection-sql plugin fails to block access to PostgreSQL system catalog tables such as pg_shadow, pg_roles, and pg_stat_activity. An admin-role user can read password hashes and database metadata through the SQL Collection feature.

A use-after-free vulnerability in the awk_sub() function (editors/awk.c) of BusyBox v1.38.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted AWK script.

A privilege escalation vulnerability in WWBN AVideo prior to version 29.0 allows any user who can solve a CAPTCHA to self-grant elevated permissions during registration via unguarded API parameters. Attackers can mark accounts as email-verified and obtain upload, streaming, and meeting creation rights.

A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a persistent denial of service (DoS).

A vulnerability in Cilium from version 1.19.0 to 1.19.4 causes standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors to erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName.

A vulnerability in Cilium allows users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default.

In DataEase before version 2.10.23, authenticated users can submit SVG files via POST /de2api/templateManage/save or DataVisualizationServer.decompression. Files are saved without validating extension, MIME type, or content, allowing stored same-origin cross-site scripting when a victim loads the resource.

Argo CD ServerSideDiff in versions 3.2.0 through 3.2.12, 3.3.10, and 3.4.2 fails to properly sanitize Kubernetes Secret data, potentially exposing sensitive values including those in the kubectl.kubernetes.io/last-applied-configuration annotation. This allows sensitive data to appear in the UI or CLI diffs.

CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to version 14.55. Attackers with local access and administrator privileges can cause a denial of service against the client they control.

CVE-2026-33443 is a memory management error in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can create a persistent DoS against the server.