CVE Vulnerability Catalog

WeGIA versions prior to 3.7.0 contain a reflected Cross-Site Scripting (XSS) vulnerability in lista_arquivos_etapa.php. The id_processo parameter is embedded directly into HTML without sanitization, allowing injection of arbitrary JavaScript.

In WeGIA versions prior to 3.7.0, a Stored Cross-Site Scripting (XSS) flaw was identified at the funcionario/profile_funcionario.php endpoint. Injecting a malicious payload into the 'Description' field and saving the profile persistently stores the script, which executes whenever the profile page is accessed.

In @workos/authkit-session prior to 0.5.1, an open redirect vulnerability exists in AuthService.handleCallback due to insufficient validation of the returnPathname value derived from the OAuth state parameter. The state parameter is round-tripped through the identity provider (IdP) and can be influenced by an attacker; handleCallback decodes and returns returnPathname without enforcing restrictions on origin or scheme, potentially redirecting the user to an external attacker-controlled site.

A security flaw has been discovered in VectifyAI PageIndex up to f50e52975313c6716c02b20a119577a1929decba. Affected by this vulnerability is the function toc_transformer of the file pageindex/page_index.py of the component PDF Table of Contents Handler. The manipulation results in infinite loop. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

The vulnerability in Summarize versions through 0.14.1 (fixed in commit 0cfb0fb) creates the daemon configuration directory and file with default filesystem permissions that may be world-readable on Unix-like systems, allowing local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json.

cowlib versions 2.6.0 to before 2.16.1 contain a CRLF injection vulnerability allowing SSE event splitting and injection via unvalidated field values. An attacker can inject additional SSE lines and forge a complete event with arbitrary type and data.

In WeGIA prior to version 3.7.0, atendido/familiar_docfamiliar.php displays an overly descriptive error message including database-related details. This verbosity leads to information disclosure that could help an attacker map the backend infrastructure and expand the attack surface. The vulnerability is fixed in version 3.7.0.

Tookie is an advanced OSINT information gathering tool. Prior to 4.1fix, write_txt, write_csv, write_json, and scan_file helpers open output files using an unsanitized username from the -u flag or -U file, allowing writes to arbitrary paths the user can write to.

In Sonatype Nexus Repository versions 3.6.0 through before 3.92.0, an authenticated user with upload permission to a hosted repository can store content that causes arbitrary JavaScript execution in the browser of any user browsing that repository directory via the HTML index page. This could allow the attacker to perform actions in the context of the victim's session.

An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet carrying RFC 7871 client subnet information. The flaw enables circumvention of query origin verification mechanisms.

A heap-based out-of-bounds read vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.

jq to narzędzie do przetwarzania JSON w wierszu poleceń. W wersji 1.8.2rc1 i wcześniejszych, standardowy loader modułów rekurencyjnie ładował moduły bez wykrywania cykli, gdy dwa poprawne moduły wzajemnie się odwołują.

Zen, a Firefox-based browser, prior to 1.19.12b incorrectly truncates long hostnames in the address bar, showing only the attacker-controlled subdomain prefix and hiding the actual registrable domain (eTLD+1). An attacker can craft extremely long malicious subdomains that visually imitate trusted brands, misleading users about the site's true origin.

W wersjach 1.8.1 i wcześniejszych jq, procesor JSON w wierszu poleceń, występuje nieograniczona rekurencja w funkcji jv_object_merge_recursive(). Umożliwia to złośliwemu programowi jq spowodowanie awarii procesu z powodu błędu segmentacji.

In jq 1.8.1 and earlier, import paths accept embedded NUL bytes at the jq-language level but are later resolved through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path jq actually opens.

In jq 1.8.1 and earlier, when decNumberFromString is given a number literal of INT_MAX-1 (2147483646) digits, the D2U() macro overflows during signed-int arithmetic. The wrapped negative value bypasses the heap-allocation size check and causes a write of roughly 1.4 GiB of attacker-controlled data outside the stack buffer.

Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization via POST /ciphers/import-organization by submitting an empty collections array, which causes the server-side permission check to be skipped.

Inbox Zero is an AI personal assistant for email. Prior to 2.29.3, the cleaner email stream endpoint used a shared Redis subscription listener, which could deliver thread events for one authenticated account to another authenticated account using the cleaner feature at the same time.

In Open edX, the HTML sanitizer clean_thread_html_body() used for discussion notification emails fails to remove <style> tags from user-generated post content. The content is rendered with Django's |safe filter in email templates, allowing any enrolled student to inject arbitrary CSS into notifications sent to other users.

Prior to 5.2.3, kafka-sink-azure-kusto did not sanitize user-controlled values in the kusto.tables.topics.mapping configuration. The db, table, mapping, and format fields of each mapping entry were interpolated directly into KQL management/query commands via String.formatted(...), allowing an actor able to influence the connector configuration to embed KQL metacharacters (;, |, ') and execute arbitrary management commands in the context of the connector's service principal.