CVE Vulnerability Catalog

macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26 fix a logic issue that could allow a malicious app to access sensitive user data.

A weakness in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 was found in the /index.php file of the SQL Handler component. Manipulation can lead to information exposure through error messages.

A Cross-Site Request Forgery (CSRF) vulnerability has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. The attack can be performed remotely, and the exploit has been publicly released.

In JeecgBoot up to version 3.9.1, a vulnerability was identified in an unknown function of the file /sys/comment/add, leading to improper access controls. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.9.2 resolves the issue.

In JeecgBoot up to version 3.9.1, a vulnerability was found in the function user.getUsername of the file /sys/user/login/setting/userEdit of the SysUser component. Manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public. Upgrading to version 3.9.2 is recommended.

Oban Web versions 2.12.0 before 2.12.5 have an uncontrolled resource consumption vulnerability in the Elixir.Oban.Web.CronExpr module. An attacker with cron job scheduling access can submit a malicious cron expression that, when viewed on the dashboard, allocates about 2.4 GB of memory, stalling or crashing the BEAM node.

In oban_web (Elixir.Oban.Web.Jobs.DetailComponent), the handle_event("save-job", ...) handler lacks authorization, allowing an authenticated user with read-only access to overwrite a job's worker field with any other Oban.Worker module. Other handlers (cancel, delete, retry) check permissions, but save-job does not.

epa4all-client version 1.2.4 and earlier allows any network-reachable caller to write arbitrary documents to any patient's electronic health record using the institution's SMC-B card. In a misconfigured deployment (e.g., following the Docker example in the README), this is exploitable from the local network without credentials.

MaxKB stores user passwords using unsalted MD5 hashes, making them easily crackable via rainbow tables or GPU-accelerated brute force.

MaxKB prior to version 2.9.1 is vulnerable to SSRF (Server-Side Request Forgery) via work_flow_template import. Authenticated users can supply arbitrary URLs in work_flow_template.downloadUrl which are fetched server-side without any URL validation or internal IP filtering.

Mistune, a Python Markdown parser, prior to 3.2.1 contains a CSS Injection vulnerability in the Image directive plugin. The regex validation for :width: and :height: options only checks for a numeric prefix, allowing arbitrary CSS injection into the style attribute. This can be used for defacement or data theft.

Mistune prior to 3.2.1 contains a Cross-Site Scripting (XSS) vulnerability in render_toc_ul(). The id and text values are inserted into <a> tags without HTML escaping, allowing an attacker to inject arbitrary HTML, including <script> tags, via a crafted heading.

Mistune prior to 3.2.1 contains an HTML Injection vulnerability in HTMLRenderer.heading(). The id attribute value is concatenated directly into the <hN> tag without escaping, allowing an attacker to inject arbitrary attributes such as event handlers, src, href, etc.

Mistune, a Python Markdown parser, up to version 3.2.0 is vulnerable to attribute injection and XSS in the render_figure() function in image.py. The figclass and figwidth options are concatenated directly into HTML attributes without escaping, even with HTMLRenderer(escape=True).

In eml_parser before version 3.0.1, the EmlParser.get_raw_body_text() function recursively processes nested message/rfc822 attachments without any depth limit. An attacker can supply a crafted EML file with approximately 120 nested parts, causing an unhandled RecursionError and aborting parsing.

Vulnerability in the view_component framework (Ruby on Rails) versions 3.0.0 to 4.9.0. The system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path. This is not a safe containment check because sibling directories can share the same string prefix. Fixed in version 4.9.0.

view_component is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the preview route derives an example name from the URL and calls it with public_send. The code does not verify that the requested method is one of the preview examples explicitly defined by the preview class. As a result, inherited public methods on ViewComponent::Preview are route-reachable. The most important one is render_with_template, which accepts template: and locals:. Those values can come from request params and are later passed to Rails as render template:. If previews are exposed, an attacker can render internal Rails templates that are not otherwise routable. This vulnerability is fixed in 4.9.0.

Mistune prior to 3.2.1 contains an HTML Injection vulnerability in the math plugin. Inline and block math content is concatenated directly into HTML output without escaping, even when escape=True is set. This allows injection of arbitrary HTML.

In Lumiverse before version 0.9.7, the consumeNonce() function does not validate any value from the incoming HTTP request or bind the nonce to the admin's session. If the admin's sign-up fails before the before hook fires (e.g., due to a duplicate email), the nonce remains set and can be used by an attacker within a 10-second window to register an unauthorized account.

MaxKB version 2.8.0 and prior are vulnerable to a broken access control vulnerability in the OSS file service URL fetch API (chat/api/oss/get_url). The endpoint uses application_id from the URL path without validating ownership, allowing attackers to perform operations under other applications’ policies.