CVE Vulnerability Catalog

The Item history widget (in Zabbix 7.0+) or the Plain text widget (in Zabbix 6.0) can execute injected JavaScript when HTML display is enabled. This can allow an attacker to perform unauthorized actions depending on which user opens a dashboard containing these widgets.

A user able to connect to Agent 2 can inject an Oracle TNS connection string via the 'service' parameter. This can lead to Agent 2 connecting to an attacker-controlled server and leaking Oracle database credentials if they are saved in a named session.

An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenance period in the Host navigator widget.

The All-in-One WP Migration Unlimited Extension plugin for WordPress up to version 2.83 lacks authorization checks when saving schedule data. Authenticated attackers with subscriber-level access can create scheduled exports and send backup filenames to attacker-controlled emails, enabling full site backup download.

The Mercado Pago payments for WooCommerce plugin for WordPress (up to version 8.7.11) lacks a capability check on the 'mp_pix_image' API endpoint. Unauthenticated attackers can retrieve PIX QR codes for arbitrary orders, exposing sensitive merchant information including PIX keys (which may contain CPF/CNPJ), transaction amounts, merchant name and city, and transaction references.

In Velocidex Velociraptor below version 0.76.5, the GetUserRoles gRPC endpoint has an authorization bypass vulnerability (CWE-639). Any authenticated low-privilege user can retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters.

An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service (DoS) via a process crash by providing a specially crafted .evtx file to the parse_evtx VQL plugin.

Jupyter Server up to version 2.17.0 persists the secret used to sign authentication cookies to a static file and does not rotate it after a password change. After a password reset and server restart, previously issued cookies remain valid, allowing an attacker who captured a session cookie to retain access despite the password change.

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the chat-messages request.

lxc, a Linux container runtime, has a logic flaw in the find_line() function of the setuid helper lxc-user-nic, allowing an unprivileged user to delete OVS-attached network interfaces belonging to other users. This affects multi-tenant environments using OpenVSwitch bridges. An attacker can repeatedly disconnect networking from containers of other tenants, causing denial of service. The issue is fixed in version 7.0.0.

Incus before version 7.0.0 sends a HEAD request to a user-supplied URL before validating project restrictions. An authenticated attacker can force the daemon to make blind HEAD requests to arbitrary destinations, leaking server metadata and enabling internal service probing.

FluentCMS 1.2.3 is vulnerable to XSS in the TextHTML plugin. An attacker can inject malicious script that executes in the victim's browser.

In PhpSpreadsheet versions 1.30.3 and earlier, 2.0.0-2.1.15, 2.2.0-2.4.4, 3.3.0-3.10.4, and 4.0.0-5.6.0, the HTML Writer skips htmlspecialchars() escaping when a cell uses a custom number format containing @ with literals. An attacker controlling cell content can inject HTML and JavaScript.

In Sandboxie-Plus versions 1.17.2 and earlier, HashPassword incorrectly converts SHA-1 digest to hexadecimal, reducing entropy from 160 to 80 bits, making password brute-force easier.

Vaultwarden version 1.35.4 and earlier is missing the has_full_access() authorization check on the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details), which exists on the sibling get_org_collections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization. The issue has been fixed in version 1.35.5.

FacturaScripts up to version 2025.92 fails to validate the 'nick' parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, an attacker can intercept the request and modify the parameter to rename any account, including the administrator.

Sandboxie versions 1.17.2 and earlier contain a local denial of service vulnerability in the kernel driver. An unprivileged process in a Standard Sandbox can send a malformed IOCTL to the \Device\SandboxieDriverApi driver, causing an immediate kernel crash (BSOD). The vulnerability affects Standard Sandbox configuration but not Security Hardened Sandbox. Fixed in version 1.17.3.

Tunnelblick to otwartoźródłowy interfejs graficzny dla OpenVPN na macOS. W wersjach od 3.3beta26 do 9.0beta01, każdy lokalny użytkownik może odczytać dowolne pliki należące do roota, wykorzystując podatność na symlink w tunnelblick-helper, dostępną przez gniazdo Unix tunnelblickd z dostępem dla wszystkich.

Vaultwarden versions 1.35.4 and earlier have a vulnerability in the WebAuthn authentication flow. The validate_webauthn_login() function updates persistent credential metadata (backup_eligible and backup_state flags) based on unverified authenticatorData before signature validation. An attacker who knows the user's password but cannot produce a valid WebAuthn signature can permanently modify the backup flags for that credential. If signature verification fails, the database update is not rolled back. This can lead to persistent denial of service of WebAuthn two-factor authentication. Fixed in version 1.35.5.

In OpenStack Horizon versions 25.6 and 25.7 before 25.7.3, a write operation to the session storage backend occurs before authentication, allowing unauthenticated requests to exhaust storage. This is a regression of the CVE-2014-8124 fix.