CVE Vulnerability Catalog

In OpenHarmony v6.0 and prior versions, a vulnerability allows a local attacker to cause information leak.

Discourse versions prior to 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1 allow an authenticated user to read the name and structured content of form templates intended exclusively for categories they are not authorized to access.

In AutoGPT (versions 0.1.0 through 0.6.51), the SendEmailBlock accepts user-supplied smtp_server and smtp_port parameters and passes them directly to smtplib.SMTP() without IP address validation, bypassing SSRF protections. An authenticated user can perform internal network port scanning and service fingerprinting.

Mantis Bug Tracker versions 2.28.0 and 2.28.1 allow a low-privileged authenticated user to create a global profile by tampering with the user_id parameter, bypassing required permissions.

GLPI (free asset and IT management software) versions 11.0.0 through 11.0.6 contain a vulnerability that allows an authenticated user with forms READ permission to export the structure of unauthorized forms.

Discourse prior to versions 2026.1.4, 2026.3.1, 2026.4.1 and 2026.5.0-latest.1 caches outdated AI summaries that can leak removed content to anonymous and unprivileged users.

FacturaScripts before version 2026 stores and serves uploaded images without stripping EXIF/XMP/IPTC metadata. Authenticated users can download an image and extract the uploader's personal data such as GPS coordinates, device information, and timestamps.

BigBlueButton prior to version 3.0.19 does not sanitize user input in public chat during recording playback. This allows a malicious actor to carry out an XSS attack that activates on anyone replaying the recording. The issue has been fixed in version 3.0.19.

A vulnerability in Claude HUD up to version 0.0.12 (fixed in commit 234d9aa) allows injection of arbitrary ANSI codes into terminal sessions due to improper construction of OSC 8 hyperlink escape sequences. Attackers can embed ESC+backslash sequences in the current working directory or branch URL, leading to execution of malicious ANSI codes such as text color changes, forged prompts, OSC 52 clipboard writes, or outbound HTTP requests when hyperlinks are clicked.

A vulnerability in Summarize prior to 0.15.1 involves insecure file permissions in the refresh-free configuration rewrite path. This causes the configuration file containing API keys and provider credentials to be created with default process umask permissions instead of preserving the original permissions, allowing local users to read sensitive data.

Summarize prior to 0.15.1 contains a missing authorization vulnerability that allows attackers to execute browser automation actions without per-call user approval when the extension automation feature is enabled. Attackers can influence the agent through malicious page or summary content to invoke enabled extension automation tools such as navigation or debugger-backed actions, bypassing the final user approval step when a user interacts with attacker-controlled content.

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios.

SimpleSAMLphp-casserver versions below 6.3.1 and 7.0.0 treat the url query parameter in the logout endpoint as trusted, allowing redirection to arbitrary external domains. This affects configurations with 'enable_logout' and 'skip_logout_page' enabled.

A missing authorization vulnerability in Summarize prior to 0.15.1 in the content script window.postMessage bridge allows malicious pages to perform unauthorized operations on automation artifacts. Attackers can simulate runtime messages with spoofed sender identifiers to list, read, create, overwrite, or delete automation artifacts scoped to the affected tab without proper authorization checks.

DumbAssets through version 1.0.11 has a stored cross-site scripting vulnerability in asset fields such as name, description, modelNumber, serialNumber, and tags. These fields are stored without server-side sanitization and rendered via innerHTML without client-side escaping. Attackers can create or update assets with HTML or JavaScript payloads through the asset API to execute arbitrary scripts in the browsers of users viewing the asset list.

Microsoft Edge (Chromium-based) contains a spoofing vulnerability that allows impersonation of trusted content or interfaces. The vulnerability can be used to mislead the user.

Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. The vulnerability relates to incorrect checking of input data.

NetBSD prior to commit ec8451e contains a signed integer overflow vulnerability in the cryptodev_op() function in sys/opencrypto/cryptodev.c where the local variable iov_len is declared as a signed int but assigned from an unsigned cop->dst_len value, causing undefined behavior when cop->dst_len exceeds INT_MAX.

NetBSD prior to commit ec8451e has a race condition in cryptodev_op() within the opencrypto subsystem. Local attackers can concurrently issue CIOCCRYPT operations on the same session identifier on SMP systems, causing a double-free condition.

HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax.