CVE Vulnerability Catalog

In Weblate prior to version 5.17.1, the screenshots, tasks, and component link API allowed enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1.

Wallos is an open-source, self-hostable personal subscription tracker. In versions 4.8.4 and prior, the webhook notification feature reuses an administrator-configured local-target allowlist for every logged-in user. Any normal user can fully control a webhook URL, headers, and body, then use Wallos to send server-side requests to allowlisted internal automation services. When such a target exposes deployment or execution APIs, this can further enable adjacent-service RCE, but that downstream result is conditional on the target service. At time of publication, there are no publicly available patches.

In Wallos prior to version 4.8.1, SSRF protection in endpoints/subscription/add.php and endpoints/payments/add.php does not block CGNAT addresses (100.64.0.0/10, RFC 6598). Authenticated users can perform Blind SSRF to internal services in Tailscale, Carrier-Grade NAT, and other environments. This issue has been patched in version 4.8.1.

fast-xml-parser prior to version 5.7.0 does not escape the "-->" sequence in comments or the "]]>" sequence in CDATA sections when building XML from JavaScript objects. This allows XML injection, leading to XSS, SOAP injection, or data manipulation.

In Weblate prior to version 5.17.1, when a user changes their password, browser sessions are correctly invalidated via cycle_session_keys(), but DRF API tokens (wlu_* prefix) stored in authtoken_token are not revoked. This issue has been patched in version 5.17.1.

Uncontrolled Resource Consumption vulnerability in ericmj decimal allows unauthenticated remote Denial of Service. The decimal library does not bound the exponent on parsed input. Storing a decimal with a very large exponent is accepted without error. Subsequent calls to arithmetic functions, formatting, conversion to integer, or comparison with a threshold allocate memory proportional to the exponent value, which can exhaust available memory and crash the BEAM VM. Any application that accepts user-supplied decimal input and performs operations on it is exposed. A single malicious request is sufficient to cause an out-of-memory crash. This issue affects decimal from 0.1.0 before 3.0.0.

Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (XSS) vulnerability via a crafted URL being rendered from cron.erb.

Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amounts of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact is limited for users of storage.images_volume and storage.backups_volume as large uploads are stored on those volumes rather than directly on the host filesystem (default behavior on IncusOS).

Incus prior to version 7.0.0 trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml if result.Config is nil. A crafted archive can carry a valid inline config that passes preflight while also carrying a malformed legacy backup.yaml without a container section, leading to nil dereference and daemon crash. The issue occurs in the restore and import flow.

Prior to version 7.0.0, Incus unpacked user-provided image and backup tarballs and parsed YAML files without any size restrictions. An authenticated user could supply a crafted image or backup tarball that, when parsed by Incus, loaded a very large YAML document into memory, potentially causing the entire server to run out of memory. This issue has been patched in version 7.0.0.

Incus prior to version 7.0.0 has missing error handling that could allow an authenticated user to cause a daemon crash through the import of a truncated storage bucket backup file. The issue has been patched in version 7.0.0.

In MISP versions before 2.5.37, there is a stored XSS vulnerability due to improper neutralization of input during web page generation. An attacker can input malicious values in the type and category fields of template element attributes.

A Cross-Site Request Forgery (CSRF) vulnerability in PluginUs.Net BEAR allows cross-site request forgery. This issue affects BEAR from n/a through 1.1.5.

A remote denial-of-service vulnerability exists in the ZTE Cloud PC client uSmartview, which may lead to memory corruption and remote denial of service. The description does not provide technical details or affected versions.

Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Poster: from n/a through 2.4.1.

The YITH WooCommerce Wishlist plugin up to version 4.12.0 contains an authorization bypass through a user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.

A Cross-Site Request Forgery (CSRF) vulnerability in WPGraphQL allows attackers to perform unauthorized actions. This issue affects WPGraphQL from n/a through 2.5.3.

Missing Authorization vulnerability in Bus Ticket Booking with Seat Reservation (before version 5.6.8) allows exploiting incorrectly configured access control security levels, enabling unauthorized access to functions.

The WEN Logo Slider plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 3.4.0. The vulnerability is due to improper neutralization of input during web page generation.

ZTE Cloud PC client uSmartView contains a DLL hijacking vulnerability. Since uSmartViewServiceAgent.exe runs with SYSTEM privileges, successful hijacking enables local arbitrary code execution, privilege escalation, and memory corruption.