CVE Vulnerability Catalog

In mailcow versions prior to 2026-03b, no administrator verification occurs when deleting Forwarding Hosts via /api/v1/delete/fwdhost. Any authenticated user can call this API, potentially significantly disrupting the mail service.

Parsing a malicious font file can cause excessive memory allocation.

Bludit CMS prior to commit 6732dde contains a reflected cross-site scripting vulnerability in the search plugin that allows unauthenticated attackers to inject arbitrary JavaScript by crafting a malicious search query. Attackers can execute malicious scripts in the browsers of users who visit crafted URLs containing the payload, potentially stealing session cookies or performing actions on behalf of affected users.

Vulnerability in Spring Security affects applications that explicitly configure One-Time Token login with JdbcOneTimeTokenService. A Time-of-check Time-of-use (TOCTOU) race condition may lead to improper functioning of the one-time token mechanism.

In Next AI Draw.io before 0.4.15, the embedded HTTP sidecar contains three POST handlers that accumulate the entire request body into memory without size limits. Sending a sufficiently large body (e.g., 500 MiB) exhausts the process heap and crashes the MCP server with an Out-of-Memory error.

In ClearanceKit before 5.0.6, the opfilter system extension can be suspended with SIGSTOP or killed with SIGKILL/SIGTERM by any process running as root. While suspended, AUTH Endpoint Security events time out and default to allow, silently disabling file-access policy enforcement.

The Home Assistant Command-line interface (hass-cli) is a command-line tool for Home Assistant. Up to 1.0.0 of home-assitant-cli an unrestricted environment was used to handle Jninja2 templates instead of a sandboxed one. The user-supplied input within Jinja2 templates was rendered locally with no restrictions. This gave users access to Python's internals and extended the scope of templating beyond the intended usage. This vulnerability is fixed in 1.0.0.

In blueprintUE prior to 4.2.0, changing a password via the profile edit page or completing a password reset does not invalidate existing authenticated sessions. An attacker who has compromised a session retains full access until the session's natural expiry.

Twenty is an open source CRM. Prior to 1.20.6, a Stored Cross-Site Scripting (XSS) vulnerability exists in the BlockNote editor component. Due to lack of protocol validation in FileBlock and insufficient server-side inspection of block content, an attacker can inject a javascript: URI into the url property of a file block, allowing arbitrary JavaScript execution when a user clicks the malicious attachment.

October is a Content Management System (CMS) and web platform. Prior to 3.7.14 and 4.1.10, a vulnerability was identified in the Twig sandbox security policy that allowed database write operations when cms.safe_mode is enabled. Backend users with Developer permissions could use Twig template markup to execute insert, update, and delete operations on any database table through the query builder, which is included in the sandbox allow-list. This vulnerability is fixed in 3.7.14 and 4.1.10.

October CMS versions prior to 3.7.14 and 4.1.10 contain a server-side information disclosure vulnerability in the handling of CSS preprocessor files. Backend users with Editor permissions could craft .less, .sass, or .scss files that leverage the compiler's import functionality to read arbitrary files from the server, even with cms.safe_mode enabled. The vulnerability is fixed in 3.7.14 and 4.1.10.

Vulnerability in Tekton Pipelines from version 0.43.0 prior to 1.0.2, 1.3.4, 1.6.2, 1.9.3 and 1.11.1. Trusted resources verification uses regexp.MatchString, which matches a pattern anywhere in the string, so unanchored patterns can be bypassed by attacker-controlled source strings containing the trusted pattern as a substring, potentially changing the verification mode or keys.

NVIDIA KAI Scheduler contains a vulnerability where an attacker could cause improper authorization through cross-namespace pod references. Successful exploitation might lead to data tampering.

HTML injection vulnerability in PHP Point of Sale v19.4. This vulnerability allows an attacker to render HTML in the victim's browser due to a lack of proper validation of user input by sending a request to '/reports/generate/specific_customer' using 'start_date_formatted' and 'end_date_formatted' parameters.

Dovestones Software AD Self Update before 4.0.0.5 is vulnerable to Cross Site Request Forgery (CSRF). The affected endpoint processes state-changing requests without requiring a CSRF token or equivalent protection. The endpoint accepts application/x-www-form-urlencoded requests, and an originally POST-based request can be converted to a GET request while still successfully updating user details. This allows an attacker to craft a malicious request that, when visited by an authenticated user, can modify user account information without their consent.

Dovestones Software ADPhonebook before 4.0.1.1 has a reflected cross-site scripting (XSS) vulnerability in the search parameter of the /ADPhonebook?Department=HR endpoint. User-supplied input is reflected in the HTTP response without proper input validation or output encoding, allowing execution of arbitrary JavaScript in the victim's browser.

A user-controlled HTTP header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

HTML injection is possible in system-generated emails in Fortra's GoAnywhere MFT prior to version 7.10.0. The title, details, and description of this CVE were corrected after publication.

Fortra GoAnywhere MFT prior to version 7.10.0 contains an improper session timeout issue. This results in SAML-configured Web Users being redirected to the regular login page instead of the SAML login page.

HCL BigFix Service Management (SM) Discovery is vulnerable to unenforced encryption due to port 80 (HTTP) being open, allowing unencrypted access. An attacker with access to network traffic can sniff packets and uncover data.