CVE Vulnerability Catalog

The 'decompress' library before version 4.2.2 allows arbitrary symlink creation during archive extraction. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory, leading to information disclosure.

An integer overflow in the jbig2_arith_iaid_ctx_new() function of the Artifex library allows an attacker to cause a Denial of Service (DoS) via a crafted input.

A security vulnerability has been detected in TOTOLINK devices (models A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, EX200) up to version 20260906. An unknown functionality in the file /etc/boa/boa.conf of the web interface leads to a least privilege violation. The attack can be initiated remotely but is considered difficult to exploit.

Python Liquid prior to version 2.2.1 contains a vulnerability that causes an infinite loop during parsing of malformed {% case %} tags without corresponding {% when %}, {% else %}, or {% endcase %} blocks. The issue arises because liquid.TokenStream.eof does not return an EOF token with matching kind and value fields, enabling a denial of service attack.

In Pimcore before versions 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint was guarded by the 'objects' permission instead of 'classes', allowing editor-level users to create class definitions without admin privileges. Missing UID format validation in the API layer allowed malformed UIDs to reach model-layer validation and expose internal exceptions.

A vulnerability in Pimcore Studio Backend Bundle allows an authenticated user to extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The input is interpolated directly into SQL with manual backtick wrapping, allowing a backtick character to break out of quoting and append arbitrary SQL.

In Pimcore before versions 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real recovery token, appends it to the supplied URL, and emails the link to the victim; when the victim clicks the link, the token is sent to the attacker and can be used to authenticate with full admin privileges while bypassing two-factor authentication.

An issue in FSM Client v.11.11c by docuForm GmbH allows a remote attacker to obtain sensitive information via the login.php component. The authentication mechanism enables user enumeration through variations in server responses.

A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c in the dfm-menu_report.php component. A remote attacker can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files, potentially leading to arbitrary code execution.

A vulnerability in docuForm GmbH Client version 11.11c allows a remote attacker to execute arbitrary code via the file upload mechanism and the report.php component.

An IDOR vulnerability in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the user settings component and modify or retrieve sensitive data from other users' accounts.

Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding rules.

A weakness has been identified in the web interface of D-link DIR-823G router version 1.0.2B05_20181207 in the file /etc/boa/boa.conf. Manipulation of this file can lead to a least privilege violation. The attack can be launched remotely but requires a high level of complexity.

Multiple protection mechanism failures in the Data Loss Prevention (DLP) component of the Prisma Access Agent for Windows allow a local user to bypass DLP policy enforcement controls. The Prisma Access Agent on macOS is not affected.

A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM allows a locally authenticated user to perform actions as the root user.

A vulnerability in Mockoon prior to 9.7.0 allows an unauthenticated attacker to remotely read MOCKOON_* environment variables, write arbitrary process environment variables, modify mock API response bodies, read transaction logs, and purge application state via the admin API, which is enabled by default and requires no authentication.

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to version 1.4.0, the development runner registers a /ws WebSocket endpoint for telephony testing that accepts connections without authentication, reads an attacker-supplied callSid from a Twilio stream-start handshake, and passes it to TwilioFrameSerializer so the server can issue an authenticated Twilio REST API hang-up request with the server operator's credentials; equivalent unauthenticated call-control sinks exist for Telnyx and Plivo.

In Kirby CMS before versions 4.9.4 and 5.4.4, users with the pages.access permission disabled could retrieve full content and metadata of any published page via the /api/site/find endpoint by knowing page IDs or UUIDs. This vulnerability allowed unauthorized access to pages that should have been protected.

A vulnerability in Kirby CMS before versions 4.9.4 and 5.4.4 allows stored cross-site scripting via malicious markup injected as children of unknown HTML/XML tags. The sanitization functions fail to properly filter such input.

A vulnerability in the Kirby content management system allows a scripting link to be injected as the target of a link in the writer field, enabling self-cross-site scripting (XSS) in the Panel. The issue affects versions prior to 4.9.4 and 5.4.4.