CVE Vulnerability Catalog

ArcGIS Server has an improper authentication vulnerability in an undocumented administrative endpoint. An unauthenticated attacker can send a crafted request to this endpoint, potentially disrupting the web-based browsing interface. This affects ArcGIS Server 12.0 and earlier.

CryptPad before 2026.2.0 has an HTML sanitizer bypass in Diffmarked.js. The sanitizer only validates the src attribute of <iframe>, <video>, and <audio> elements, leaving other attributes like srcdoc unchecked. An attacker can inject arbitrary HTML, defeating bounce sandboxing.

Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file. The TXTRenderer component fails to sanitize file content and explicitly casts raw data as a ReactNode.

In Splunk Enterprise before versions 10.2.2, 10.0.5, 9.4.11, 9.3.12 and Splunk Cloud Platform before specified versions, a low-privileged user (without admin or power roles) can cause a denial of service (DoS) by exploiting the coldToFrozen.sh script in the splunk_archiver app to rename critical Splunk directories, making the instance non-functional.

In Splunk AI Toolkit versions below 5.7.3, a low-privileged user without 'admin' or 'power' roles could access confidential data restricted by `srchFilter` configurations on custom roles. The app contains an `authorize.conf` file with a `srchFilter` entry that modifies the built-in 'user' role. Because Splunk combines inherited search filters with the `OR` SPL operator, the injected filter overrides more restrictive filters on child roles.

Prototype pollution in CSV parsing logic during import can lead to untrusted file paths (but not arguments) entering shell.openExternal after specific user behavior, enabling '1-click' command execution.

The MongoDB C Driver's legacy GridFS API accepts malformed file metadata from the database without adequate validation. Crafted documents in a GridFS collection may cause any application that reads those files via the legacy API to either crash (via a division-by-zero) or silently leak process memory contents (via an out-of-bounds read).

In Keycloak, the cross-session verification proof is keyed only by (localUserId, idpAlias) and is not bound to the upstream identity. A second upstream account on the same IdP can consume it and get linked to the victim's local account.

InfoScale VIOM version 9.1.3 contains an XSS vulnerability.

SQL injection vulnerability in InfoScale VIOM before version 9.1.3 allows remote attackers to escalate privileges.

Cisco ThousandEyes Enterprise Agent has a vulnerability in the BrowserBot component that allows an authenticated remote attacker to execute arbitrary commands in the BrowserBot container as the node user. The vulnerability is due to insufficient input validation of command arguments.

A vulnerability in Cisco ThousandEyes Virtual Appliance allows an authenticated remote attacker with admin privileges to execute arbitrary code as root by uploading a crafted SSL certificate.

Cisco Nexus 3000 and 9000 Series Switches in standalone NX-OS mode have a vulnerability in the BGP enforce-first-as feature. Incorrect parsing of a transitive BGP attribute allows an unauthenticated, remote attacker to trigger BGP session flaps, leading to denial of service.

MISP’s OIDC authentication plugin allowed automatic linking of an OIDC identity to an existing local user account based on the email claim when the local account had no stored sub value. Under insecure or untrusted IdP configurations where email ownership is not enforced, an attacker with a valid OIDC token could assert a victim’s email address and authenticate as that user, leading to account takeover.

Progress Software MOVEit Automation has a resource allocation vulnerability without limits or throttling, leading to excessive allocation. This affects versions before 2025.0.11 and from 2025.1.0 before 2025.1.7.

Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.

Resource allocation without limits or throttling vulnerability in Progress Software MOVEit Automation allows flooding attacks. Affects versions before 2025.0.11 and from 2025.1.0 before 2025.1.7.

Kieback & Peter DDC building controllers are vulnerable to cross-site scripting (XSS), enabling JavaScript execution in the victim's browser, allowing the attacker to control the browser.

Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of miniscript policies containing the 'a:' fragment. Attackers can craft malicious miniscript policies that cause the device to derive and display incorrect receiving addresses, potentially leading to funds being sent to unintended addresses.

Uncontrolled memory allocation in Progress Software MOVEit Automation allows excessive allocation, potentially leading to resource exhaustion.