CVE Vulnerability Catalog

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the file /cgi-bin/mainfunction.cgi of the Apmupload component allows path traversal via manipulation of the action argument. The attack can be carried out remotely, and the exploit has been made public. Upgrading to version 1.5.1.7 resolves the issue.

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.

In the embedded co-browsing feature in Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2 (on-premises and cloud), an unauthenticated remote attacker in the visitor role can execute arbitrary JavaScript in the browser of an agent participating in the attacker's co-browsing session, via content rendered as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or Single Conversation Desk. Exploitation requires an agent to join a session with the attacker; mobile co-apping is not affected.

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module. Unauthenticated attackers can download stored files through the filer/download and filer/display routes by supplying arbitrary disk names and paths to FileController.

DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated users with edit rights can race concurrent draft rewrites to splice serialized data, instantiating gadgets like MemoryIndex or Installer.

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.

Apache Cocoon has an exposure of sensitive system information to an unauthorized control sphere vulnerability. An unauthenticated user could access diagnostic interfaces, including triggering cache operations and exposing verbose debug logging and profile information. The project is retired and no fix is planned.

The vulnerability in Apache Cocoon involves the use of a cache containing sensitive information. In multi-user applications, cached values for one user could be used when serving content for other users.

The vulnerability in Apache Cocoon involves improper neutralization of special elements used in SQL commands (SQL injection). Missing input sanitation allows arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets.

The vulnerability in Apache Cocoon involves improper restriction of recursive entity references in DTDs (XML entity expansion). XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system.

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. The vulnerability was patched on 22 July 2026, and no customer action is needed.

A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.

A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.

A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.

A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.

A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.