CVE Vulnerability Catalog

RouterOS provides various services that rely on correct verification of client and server certificates, including OpenVPN, CAPsMAN, Dot1x (802.1X). The vulnerability lies in shared certificate validation logic that uses the system certificate store shared by all services. This causes confusion of scope, allowing any certificate authority in the system-wide trust store to be trusted in any context, enabling partial or full authentication bypass in CAPsMAN, OpenVPN, Dot1X and potentially others.

Vulnerability in Apache Thrift involving memory allocation with excessive size. Affects versions before 0.23.0.

An issue was discovered in the PaperCut Hive Ricoh embedded application: when "Deep Logging" (diagnostic) mode is enabled, the application records administrative credentials in plain text within log files. An attacker with administrative access to the PaperCut Hive management portal could remotely enable deep logging and retrieve sensitive device passwords from logs after an authorized user authenticates at the device. This exposure allows lateral movement or unauthorized configuration of the physical print hardware.

In the Shared Account Synchronization component of PaperCut MF (version 25.0.4), an authenticated user with administrative privileges can specify arbitrary local file paths due to lack of path validation. This allows enumeration of directory structures and unauthorized reading of sensitive configuration or system files, whose contents are then exposed in the account management interface.

A vulnerability was identified in itsourcecode Courier Management System 1.0 in an unknown function of /print_pdets.php. Manipulating the ids argument leads to SQL injection. The attack may be initiated remotely and the exploit is publicly available.

In Nix before 2.34.7, writing to arbitrary files can occur via directory traversal in "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack". Fixed versions are 2.34.7, 2.33.6, 2.32.8, 2.31.5, 2.30.5, 2.29.4, and 2.28.7 (introduced in 2.24.7).

In CodeCanyon Perfex CRM up to 3.4.1, the AbstractKanban::applySortQuery function in application/services/AbstractKanban.php (Admin Kanban Endpoint component) is vulnerable to SQL injection via manipulation of the this argument. The attack can be initiated remotely, and the exploit has been published and may be used.

A vulnerability was detected in CodeCanyon Perfex CRM up to 3.4.1 in the Clients::project function of application/controllers/Clients.php in the Tenant Handler component. Manipulating the ID argument results in authorization bypass. The attack may be performed remotely and the exploit is now public.

Nginx UI prior to version 2.3.8 has a GetSettings API handler that serializes all settings structs to JSON and returns them to authenticated users. Many sensitive fields tagged protected:"true" are only enforced during writes, exposing 40+ protected fields including JwtSecret, NodeSecret, OIDC ClientSecret, and the IP whitelist configuration.

Nginx UI prior to version 2.3.8 allows an authenticated user to call GET /api/settings and retrieve sensitive configuration values, including node.secret. The same node.secret is accepted by AuthRequired() through the X-Node-Secret header or node_secret query parameter, causing the request to be treated as authenticated via the trusted-node path and associated with the init user.

In the Claude SDK for TypeScript from version 0.79.0 to before 0.91.1, the BetaLocalFilesystemMemoryTool created memory files and directories using Node.js default modes (0o666 for files, 0o777 for directories), leaving them world-readable under a standard umask and world-writable in environments with a permissive umask such as many Docker base images.

In CImg Library prior to commit c3aacf5, the nb_colors field read from the BMP file header is used directly to compute an allocation size without validating it against the remaining file size. A crafted BMP file with a large nb_colors value triggers an out-of-memory condition, crashing any application that uses CImg to load untrusted BMP files.

In CImg Library (a C++ image processing library) prior to commit 4ca26bc, an integer overflow in the W*H*D size computation inside _load_pnm() can bypass the memory allocation guard. A crafted PNM/PGM/PPM file with large dimension values causes the overflow to wrap around, allocating an undersized buffer and potentially triggering a heap buffer overflow.

PlantUML Macro is a macro for rendering UML diagrams from simple textual schemes. Prior to version 2.4.1, the PlantUML Macro is vulnerable to Server-Side Request Forgery (SSRF). The macro allows users to specify an alternative PlantUML server via the server parameter. However, the application does not validate the supplied URL. An attacker can supply an internal IP address or a malicious external URL. The XWiki server will attempt to connect to this URL to "render" the diagram.

Dify prior to version 1.13.1 allows any unauthenticated user to upload an SVG file containing XSS via the POST /api/files/upload endpoint. The POST /v1/files/upload endpoint, which requires application API authentication, is also vulnerable. The issue has been patched in version 1.13.1.

In titra version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. No public patch is available at the time of publication.

In goshs (a SimpleHTTPServer written in Go) prior to version 2.0.2, the PUT upload handler lacks the CSRF token validation added to the POST handler in the CVE-2026-40883 fix. Combined with the unconditional Access-Control-Allow-Origin: * on the OPTIONS preflight handler, any website can write arbitrary files to a goshs instance through the victim's browser, bypassing network isolation.

OpenC3 COSMOS prior to version 7.0.0 uses an unsafe eval() function on array-like command parameters in the Command Sender UI. This allows a user-supplied payload to execute in the browser when sending a command, creating a self-XSS risk. An attacker can trigger their own script execution in the victim's session if allowed to influence the array parameter input, for example via phishing.

OpenC3 COSMOS prior to versions 6.10.5 and 7.0.0-rc3 contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although standard path traversal attacks are mitigated, all plugins share the same root directory, enabling users to create arbitrary file structures and overwrite existing configuration files.

Beets is a media library management system. Prior to version 2.10.0, the bundled web UI used Underscore template interpolation mode <%= ... %> for untrusted metadata fields, leading to the possibility of injecting malicious HTML code.