CVE Vulnerability Catalog

In Gitea 1.26.2, unauthorized users can access labels of private organizations. This vulnerability allows information disclosure of labels that should be restricted to organization members.

In Gitea versions before 1.25.5, there is a vulnerability due to insufficient permission checks when updating or rebasing pull request branches.

A vulnerability in Gitea 1.26.2 allows fork synchronization to continue after a parent repository changes from public to private, leading to unauthorized data exposure.

A vulnerability in Gitea before version 1.26.0 allows API users to fork a repository into an organization without passing the CanCreateOrgRepo check, potentially exposing organization secrets.

A vulnerability in Gitea versions 1.5.0 through 1.26.2 allows a valid TOTP code to be reused multiple times during two-factor authentication via web flows and Basic Auth with the X-Gitea-OTP header.

A security flaw in RT-Thread up to version 5.0.2 affects the CAN_Receive function in the SWM341.h file of the SWM341 CAN Handler component. A local attacker can trigger a stack-based buffer overflow through data manipulation. A public exploit is available for attacks.

A stack-based buffer overflow vulnerability was found in RT-Thread up to version 5.0.2 in the ls1c CAN Handler component's recvmsg function. The attack requires local access and the exploit is publicly available.

A heap buffer overflow vulnerability was found in GIMP's Paint Shop Pro (PSP) file format parser. The flaw occurs due to incorrect buffer size calculations when processing low bit-depth images, allowing a remote attacker to execute arbitrary code or cause a denial of service (DoS) by tricking a user into opening a specially crafted PSP file.

Dell PowerProtect Data Domain in multiple versions contains an OS command injection vulnerability. A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands.

Dell PowerProtect Data Domain in multiple versions contains an OS command injection vulnerability. A high-privileged attacker with remote access could exploit this flaw to execute arbitrary OS commands.

Dell PowerProtect Data Domain in multiple versions contains an OS command injection vulnerability. A high-privileged attacker with remote access could exploit this flaw to execute arbitrary commands.

Missing authorization in TUBITAK BILGEM's pardus-software allows argument injection. The vulnerability affects versions 1.0.4 and earlier, before version 1.0.5.

An argument injection vulnerability in TUBITAK BILGEM's pardus-software allows attackers to inject additional arguments into commands. The issue affects versions up to 1.0.4 and is fixed in version 1.0.5.

A vulnerability in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0 allows a remote attacker to perform an indirect prompt injection attack and execute unintended API requests.

In Eclipse Theia since version 1.26.0, the backend /services/request-service RPC endpoint accepts an attacker-controlled URL from any client connected to the standard /services messaging endpoint, performs the HTTP request server-side, and returns the full response body to the caller. Because the destination URL is neither validated nor allowlisted, a remote attacker with access to the Theia service connection can issue server-side HTTP requests to localhost or other backend-reachable hosts and read their responses.

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket without service-level authentication. WebSocket origin validation is fail-open, allowing attackers to execute arbitrary OS commands.

A Path Traversal vulnerability in the Apache Lucene.Net.Replicator library allows unrestricted file reading outside the restricted directory. The issue affects versions from 4.8.0-beta00005 through 4.8.0-beta00017.

The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.

A Path Traversal vulnerability in the Lucene.Net.Replicator library allows unauthorized access to files outside the restricted directory. Affected versions are from 4.8.0-beta00005 to 4.8.0-beta00017.

A vulnerability in libcurl allows accepting an untrusted server during SCP or SFTP transfers when using the CURLOPT_SSH_KEYFUNCTION callback. The server can present a host key type different from the one recorded in the known_hosts file, and the callback mechanism fails to enforce rejection, allowing the connection to succeed without warning.