CVE Vulnerability Catalog

In NousResearch hermes-agent up to version 2026.4.30, an injection vulnerability exists in the _sanitize_env_lines function of hermes_cli/config.py. The attack can be launched remotely but requires high complexity. The exploit has been publicly released.

An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).

An improper input validation vulnerability in the OTRS Customer Backend module allows access to customer information restricted to other groups. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, but only when the CustomerGroupSupport feature is enabled.

An uncontrolled resource allocation vulnerability in OTRS email handling can lead to excessive resource consumption and webserver abortion. This affects versions 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, and likely also OTRS Community Edition 6.x and OTRS 7.x.

Vulnerability in the WLAN STA driver on Android (MediaTek chipset) allows a system crash due to a missing bounds check, leading to local denial of service.

In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6786.

In geniezone, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege if an attacker already has System privilege. User interaction is not required for exploitation.

A vulnerability was found in nextlevelbuilder GoClaw up to version 3.11.3 in the auth function of file internal/http/evolution_handlers.go, leading to improper authorization. The attack can be executed remotely, and the exploit has been disclosed publicly. The project tagged the issue as a bug.

Vulnerability in GoClaw (nextlevelbuilder) up to version 3.11.3 allows improper privilege management through manipulation in the handleSave function of the file internal/http/tts_config.go. Affects the RoleAdmin Gateway component.

Dolibarr ERP CRM up to 23.0.1 has an improper authorization vulnerability in the checkUserAccessToObject function in the Leave Request API.

A security flaw was discovered in AstrBotDevs AstrBot 4.23.6. It affects unknown code in the file /api/skills/delete of the API Endpoint component. Manipulating the Name argument results in path traversal. The attack can be initiated remotely. The exploit has been released.

Vulnerability in AstrBot (AstrBotDevs) version 4.24.2 allows authorization bypass by manipulating the session_id argument in the astr_main_agent function of the file astrbot/core/astr_main_agent.py.

An incorrect authorization vulnerability was found in AstrBot 4.23.6 in the function _normalize_rw_path in file astrbot/core/tools/computer_tools/fs.py. The attack can be performed remotely, and the exploit is publicly available. The vendor did not respond to the disclosure.

A vulnerability was found in AstrBot version 4.23.6 in the function _sanitize_prompt_description of file astrbot/core/skills/skill_manager.py, allowing remote injection. The exploit has been made public, and the vendor did not respond.

A SQL injection vulnerability was found in code-projects Online Hospital Management System 1.0 in the file appointmentdetail.php of the Appointment Handler component via the editid argument. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was found in MetaCRM 6.4.0 by Metasoft 美特软件 in the file develop/systparam/softlogo/upload.jsp. An unknown function allows unrestricted file upload. The attack can be performed remotely and the exploit has been published.

In OFCMS 1.1.3, the Query function in SysUserController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was found in OFCMS 1.1.3 in the JSON Query interface in SystemParamController.java. The Query function allows SQL injection. The attack can be performed remotely and the exploit has been published.

In OFCMS 1.1.3, the Query function in SystemDictController.java (JSON Query Interface component) is vulnerable to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

In Assimp up to version 6.0.4, a vulnerability was found in the function glTFCommon::CopyValue in library glTFCommon.h of the 4x4 Matrix Parser component. Manipulation leads to a heap-based buffer overflow. The attack requires local access.