CVE Vulnerability Catalog

FastGPT before version 4.15.0-beta1 has a vulnerability in the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356. The regex blocking dynamic import() does not account for block comments between 'import' and '('. An attacker can use the payload import/**/("child_process") to bypass the regex and execute arbitrary commands as uid=100(sandbox) inside the sandbox container.

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.

TP-Link TL-SG108PE v5 switch has a stored cross-site scripting vulnerability in the web management interface due to improper sanitization of the SYSNAM configuration parameter during configuration file import. An attacker with administrator access can inject malicious script that executes in the administrator's browser when viewing the interface.

In JetBrains YouTrack before 2026.1.13570, improper access control allowed enumeration of restricted issues and articles on Planning Canvas.

In JetBrains YouTrack before 2026.1.13570, improper access control allowed low-privileged users to modify service accounts.

In JetBrains PyCharm before version 2025.3.4, a stored XSS vulnerability was found in Jupyter notebook Markdown cells. An attacker can inject malicious JavaScript that executes in the browser of any user viewing the notebook.

In JetBrains IntelliJ IDEA before 2026.1, code execution was possible via template injection in the Copyright plugin.

In JetBrains TeamCity before 2026.1, credentials could be exposed in thread names.

In JetBrains TeamCity before 2026.1, credentials parameters were exposed via parameter autocompletion.

In JetBrains TeamCity before 2025.11.2, sensitive data is exposed via default agent parameters.

In JetBrains TeamCity before 2026.1, insufficient username validation in the SAML plugin.

JetBrains TeamCity before versions 2026.1 and 2025.11.5 is vulnerable to reflected XSS on the repository download page. An attacker can inject a malicious script that executes in the victim's browser.

A vulnerability was found in JetBrains YouTrack before version 2026.1.13162 that allows information disclosure on the Users and Groups pages.

Shopper before version 2.8.0 does not check permissions for enable/disable, edit, and delete actions in admin tables for PaymentMethods, Currencies, and Carriers. A low-privilege user can disable payment methods, change the default currency, or disable carriers.

Shopper before version 2.8.0 has a vulnerability in Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files), where the store() method lacks authorization. Any authenticated user can modify prices, stock, SEO metadata, shipping dimensions, and attachments of any product.

In Shopper, a headless e-commerce admin panel prior to version 2.8.0, the CreateOrderFromCartAction::execute function created the order before checking and incrementing the discount's total_use counter. Under concurrent checkout pressure (Black Friday, flash sale, viral coupon), the global usage_limit was silently exceeded: orders were committed with the discount fully applied while the counter blocked at the limit. The merchant had no signal of over-redemption.

liboqs prior to version 0.16.0 has an out-of-bounds read vulnerability in the XMSS and XMSS^MT signature verification code, potentially leading to a crash (denial of service).

SillyTavern before version 1.18.0 contains an SSRF vulnerability in corsProxyMiddleware, which forwards the URL from req.params.url directly into fetch(). Only circular requests to its own host are blocked, with no destination allowlist or private/loopback restrictions.

SillyTavern before version 1.18.0 does not HTML-escape attacker-controlled URL values before sending them in error responses. This allows cross-site scripting (XSS) via crafted requests.

In Danelec MacGregor Voyage Data Recorder, passwords are stored with a hashing method that limits password length and is susceptible to brute force attacks.