CVE Vulnerability Catalog

A vulnerability was found in the blender-mcp project in the Open function of server.py. Manipulating the input_image_url argument can lead to remote injection. The exploit has been publicly disclosed.

A flaw has been found in warmcat libwebsockets up to version 4.5.8. The issue affects the function lws_ssh_parse_plaintext in the file plugins/protocol_lws_ssh_base/sshd.c. Manipulation of the msg_len argument can lead to resource consumption. The attack can be launched remotely and the exploit is publicly available.

Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthorized individuals with physical access to compromise software integrity via USB interface manipulation. Attackers can exploit the unprotected USB interfaces to impair therapy functions, manipulate device-processed data, or leverage the device as a pivot point for broader network-based attacks when connected to a network or Dräger Service Connect.

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to read arbitrary files. Attackers can exploit the unauthenticated HTTP server bound on all interfaces to traverse outside the project root and access sensitive files.

The CloudburstMC Protocol library prior to version 3.0.0.Beta12-20260420.182526-15 partially misses validation for FULL type authentication tokens, affecting EncryptionUtils methods for validating auth payloads.

In authentik before version 2026.2.3, the WS-Federation provider validates the wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker can craft a login link with a wreply on a different origin that passes the check, causing the login response to be sent to attacker-controlled infrastructure.

SourceCodester Human Resource Management 1.0 has a vulnerability in the file /detailview.php of the Employee View Page component. Manipulation of the employeeid argument leads to improper control of resource identifiers. Remote attack is possible and the exploit has been disclosed.

The ARMember Premium plugin for WordPress up to version 7.3.1 is vulnerable to SQL Injection via the 'sSortDir_0' parameter of the get_private_content_data AJAX action. Insufficient sanitization allows the parameter to be concatenated directly into the ORDER BY clause. Authenticated attackers with Subscriber-level access or above can inject additional SQL queries to extract sensitive data. The vulnerability is only exploitable when the "User Private Content" addon is enabled (disabled by default).

FastNetMon Community Edition through 1.2.9 has an out-of-bounds read in the IPv4 packet parser. After validating at least 20 bytes, the code advances the pointer by 4 * IHL without checking IHL >= 5 or available bytes. IHL=15 with only 20 bytes causes a 40-byte over-read; IHL 0-4 leads to type confusion.

Resource exhaustion vulnerability in the Tesla library (Elixir) before version 1.18.3. Tesla.Adapter.Mint.open_conn/2 converts the URL scheme of every request to a BEAM atom without validation, potentially filling the atom table and crashing the VM. An attacker can influence the request URL via redirect features or webhooks.

Tesla library (Elixir) versions from 1.4.0 before 1.18.3 improperly handle case sensitivity in HTTP headers during cross-origin redirects. The Authorization header in canonical form (e.g., "Authorization") is not filtered, leading to credential leakage to a third-party origin.

React Router versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3 contain an open redirect vulnerability where certain URLs passed to the redirect function can be reinterpreted as protocol-relative URLs, redirecting to an external domain.

Wire iOS client up to version 4.15.0 crashes upon receiving a crafted malicious Proteus message with an encrypted payload shorter than 16 bytes. The crash is automatic and the message persists, causing a crash loop on relaunch. Fixed in version 4.16.0.

AIOHTTP, an asynchronous HTTP framework for Python, prior to version 3.14.0 has a vulnerability in the CookieJar.load() function that allows arbitrary code execution when using untrusted input. Most applications use this function with their own data, so the risk is low, but if attacker-controlled files are loaded, remote code execution may occur.

Northern.tech CFEngine Enterprise 3.24.3 before 3.24.4 and 3.27.0 before 3.27.1 allows XSS.

Cross Site Scripting vulnerability in usememos Memos v.0.26.0 allows a remote attacker to obtain sensitive information via the SANITIZE_SCHEMA, Memo Rendering Component, and Public/Private Memo View pages.

JIT miscompilation in the JavaScript Engine of Firefox. This vulnerability was fixed in version 151.0.3.

A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete of the file internal/tools/team_tasks_lifecycle.go of the component Team Task Completion Handler. Executing a manipulation can lead to missing authorization. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The project tagged the reported issue as bug.

The proxy server in Graph Explorer before version 3.0.1 falls back to HTTP when certificate files are missing. A remote attacker can intercept requests intended for HTTPS, obtaining sensitive information.

Dräger Atlan A350 versions 1.00 to 1.01 have an improper input handling vulnerability via the Medibus interface. Sending specially crafted non-Medibus-compliant data can overload the processor, gradually disrupting device operation over hours, causing data loss, delayed curve display, and pressure deviations.