CVE Vulnerability Catalog

In liboqs before 0.16.0, an out-of-bounds read occurs in XMSS/XMSS^MT signature verification when the signature buffer is shorter than expected. The implementation does not validate the length and reads past the buffer, potentially causing a crash (DoS).

An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device, which includes account data and password hashes.

The administrator account of the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive authentication files, potentially changing the root password.

Statamic prior to versions 5.73.22 and 6.18.1 contains a vulnerability in the Glide image proxy. URL validation could be bypassed, allowing an unauthenticated attacker to make HTTP requests to internal addresses (loopback, private network, cloud metadata).

In Arcane 1.18.1 and earlier, the GET /environments/{id}/volumes/{volumeName}/browse endpoint accepts a path query parameter that is passed to a shell command (sh -c "find … | while …") inside an Arcane helper container. The path sanitizer blocks ../ traversal but does not strip Bourne-shell metacharacters such as $() or backticks, and strconv.Quote only escapes Go string metacharacters, not shell substitution sequences. Any authenticated user with access to a browseable volume can execute arbitrary commands inside the helper container; command output is reflected back in the 500 error body.

Neotoma from 0.6.0 to before 0.11.1 can treat public reverse-proxied requests as local when received over a loopback socket without a Bearer token. This allows unauthenticated access to the Inspector and related API surface.

In Dokploy version 0.19.0 and earlier, the protectedProcedure middleware only verifies user authentication but does not enforce organization scoping. Each endpoint must individually verify that the resource belongs to the user's organization. This affects multiple endpoints in various files.

Macrozheng mall up to version 1.0.3 has an authorization bypass vulnerability in the Super Admin Password Handler component in the /admin/update/ file. The attack can be performed remotely.

Bolt CMS up to version 3.7.0 contains an SQL injection vulnerability in the 'order' parameter of content listing pages. An authenticated attacker with low privileges can exploit this via the OrderDirective component, allowing extraction of sensitive information.

SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of user supplied input in the user registration functionality in register.php.

OpenClaw before 2026.4.29 contains an SSRF policy bypass vulnerability in browser debug and export routes that allows reuse of already-open blocked tabs. Attackers can bypass private-network SSRF policies by reusing blocked tabs to export or inspect protected content.

OpenClaw before version 2026.4.29 contains a policy bypass vulnerability in QQBot admin commands. Authenticated senders can skip DM-only and allowFrom policy checks, allowing them to route admin commands from unauthorized senders or contexts to execute restricted behavior that policy should have blocked.

QuickCMS allows a user's session identifier to be set before authentication. The value of this session ID stays the same after authentication. This enables an attacker to fix a session ID for a victim and later hijack the authenticated session.

OpenClaw before version 2026.5.12 contains a privilege escalation vulnerability in Slack plugin approvals. Users with limited exec permissions can bypass approval splits and approve plugin actions outside operator configuration.

In ACM/MCE assisted-service, when pull-secret validation fails, raw pull-secret contents are written into `InfraEnv.status.conditions[].message`. A user with the default `view` ClusterRole cannot directly read Secrets, but can read InfraEnv objects and recover the referenced Secret's `.dockerconfigjson` data from status.

In XX-Net version 5.16.6, a WebSocket frame parsing vulnerability exists in the WebSocket_receive_worker function. The server always reads 4 bytes as a masking key regardless of the MASK flag, leading to data corruption and missing validations.

A stack-based buffer overflow vulnerability was discovered in the TRENDnet TEW-432BRP router version 3.10B20 in the formSetPortTr function of /goform/formSetPortTr. The attack can be performed remotely by manipulating the special_name argument. The vendor states the product has been EOL for 15 years and will not be fixed.

PHP-SHOP 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to add administrative users by crafting malicious HTML forms. Attackers can trick authenticated administrators into visiting a page with a hidden form that automatically submits POST requests to users.php with admin permissions.

Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by injecting directory traversal sequences in the id parameter. Attackers can send GET requests to navigate_download.php with payloads like ../../../cfg/globals.php to access sensitive configuration and system files outside the intended directory.

HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint. Attackers can craft malicious forms targeting the aksi_user.php script with parameters like id_user, password, and level to modify admin credentials without authentication.