CVE Vulnerability Catalog

MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch functionality due to inconsistent DNS resolution between validation and actual request execution, allowing attackers to access internal network services.

MaxKB before version 2.8.1 is vulnerable to a server-side request forgery (SSRF) bypass in the OSS file service URL fetch endpoint. Inconsistent URL parsing between the validation function and the HTTP client allows attackers to access internal network services.

PbootCMS version 3.2.11 contains a code injection vulnerability in its site configuration functionality.

Snipe-IT prior to version 8.4.1 has an open redirect vulnerability via an unvalidated HTTP Referer header stored in a session variable. Attackers can redirect users to malicious sites.

Snipe-IT prior to version 8.4.1 has an XSS vulnerability in the notes column for users with component view access. Insufficient escaping allows script injection.

In eventsource-encoder prior to 1.0.2, the event and id fields of an EventSourceMessage are not sanitized before serialization. An attacker controlling either field can inject arbitrary Server-Sent Events line terminators and forge additional SSE fields or entire messages.

The WpTravelly plugin for WordPress up to version 2.1.5 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.

The WpBookingly plugin for WordPress up to version 1.2.9 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.

Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce allows exploiting incorrectly configured access control security levels. This affects versions from n/a through 2.0.1.

The Tiktok Feed plugin for WordPress up to version 1.0.24 suffers from missing authorization, allowing exploitation of incorrectly configured access control security levels.

SailingLab AppLock (com.alpha.applock) version 4.3.8 for Android allows a local attacker to execute arbitrary JavaScript via BrowserMainActivity, which accepts VIEW intents with javascript: URIs. This may lead to UI spoofing and privilege escalation.

In ThingsBoard up to version 4.3.1.1, a vulnerability in the getGatewayDockerComposeFile function of /api/v1/provision (YAML Handler component) allows code injection. Remote attack is possible but difficult.

In teableio teable up to version 1.9.x, the Sign-up component in apps/nextjs-app/src/features/auth/pages/LoginPage.tsx is vulnerable to cross site scripting via the redirect argument. The attack is remotely exploitable and the exploit is publicly available.

A maliciously crafted WRL file, when parsed through Autodesk 3ds Max, can cause a Stack Exhaustion vulnerability, leading to a denial-of-service condition.

A maliciously crafted PAR file, when parsed through Autodesk 3ds Max, can force a NULL Pointer Dereference vulnerability, causing the application to crash and leading to a denial-of-service condition.

FastNetMon Community Edition up to version 1.2.9 has a buffer overflow. This is a different vulnerability than CVE-2026-48686 and CVE-2026-48689.

Kavita, a cross-platform reading server, has a vulnerability in download and size-check endpoints. A low-privileged user can access content from libraries they are not assigned to if they know the chapter, volume, or series IDs.

In Kavita prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowing unauthenticated access to page images from any chapter in any library. The apiKey parameter is not validated, and entity IDs are sequential, enabling easy enumeration of all server content.

SAP Gateway allows attackers to inject content into error messages, potentially disclosing request artifacts (e.g., regex patterns) and URI parsing logic. Impact on confidentiality is low.

Chatwoot is a customer engagement suite. From 2.14.0 to before 4.13.0, a Pre-Account Takeover (Pre-ATO) vulnerability existed in Chatwoot's authentication flow. Because email confirmation was not enforced before an account became usable, an attacker could pre-register an email address they did not own and set a password. If the legitimate owner of that email later signed in to Chatwoot using Google OAuth (or another OmniAuth provider), the OAuth flow silently confirmed the existing account without invalidating the attacker's pre-set credentials. The attacker could then continue to log in with the password they had originally chosen and access any data the victim subsequently entered into the dashboard, including PII, API keys, and other sensitive information. This vulnerability is fixed in 4.13.0.