CVE Vulnerability Catalog

Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter (`str_replace('../', '', $input)`) to prevent path traversal. The filter can be bypassed using patterns like `..././` or `....//`, which after replacement still result in `../`. An authenticated administrator can read arbitrary files from the server filesystem.

Dell PowerProtect Data Domain versions 8.5 through 8.6 contain a command injection vulnerability. A high-privileged attacker with remote access could exploit it to execute arbitrary commands with root privileges.

A vulnerability exists in Buffalo Link Station version 1.85-0.01 that allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles. The issue is triggered by modifying a parameter within requests sent to the /nasapi endpoint.

A weakness has been identified in Pagekit CMS up to 1.0.18, affecting the evaluate function in app/modules/view/src/PhpEngine.php (StringStorage Template Handler component). The manipulation causes improper neutralization of directives in dynamically evaluated code, enabling remote exploitation; the exploit is publicly available and the vendor did not respond to the disclosure.

In the Junrar library prior to version 7.5.10, a path traversal vulnerability in the `LocalFolderExtractor` class allows an attacker to write arbitrary files with attacker-controlled content into sibling directories when extracting a crafted RAR archive.

In OpenProject prior to version 17.3.0, a user with manage_agendas permission in any project can inject agenda items into meetings belonging to any other project, even those they cannot access. An attacker can blindly spray items into every meeting by iterating sequential section IDs.

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both tar and ZIP. This can cause confusing installation behavior, such as installing 'incorrect' files according to the archive filename. New behavior only proceeds if the file uniquely identifies as ZIP or tar, not both.

Vvveb prior to version 1.0.8.1 contains a stored cross-site scripting vulnerability that allows authenticated users with media upload and rename permissions to bypass MIME type validation by prepending a GIF89a header to HTML/JavaScript payloads, then renaming the file to .html extension. This enables arbitrary JavaScript execution in an administrator's browser session, potentially leading to backdoor account creation and malicious plugin uploads for remote code execution.

A vulnerability was found in Qibo CMS 1.0 affecting an unknown function of the /index/image/headers file. Manipulating the starts argument can lead to server-side request forgery, and the attack can be launched remotely. The exploit has been publicly disclosed.

W podatności CVE-2026-6369 występuje niewłaściwa kontrola dostępu w kliencie canonical-livepatch przed wersją 10.15.0, co pozwala lokalnemu użytkownikowi bez uprawnień na uzyskanie wrażliwego tokena uwierzytelniającego na poziomie roota poprzez wysłanie nieautoryzowanego żądania do gniazda Unix livepatchd.sock. Problem ten występuje na systemach, gdzie administrator włączył klienta Livepatch z ważną subskrypcją Ubuntu Pro.

Apache Kafka's NetworkClient component logs full requests and responses at DEBUG level, potentially exposing sensitive information such as SASL authentication data and delegation tokens. The issue affects versions up to 3.9.1 and 4.0.0.

Apache Doris MCP Server before version 0.6.1 has an improper neutralization flaw in query context handling that may allow execution of unintended SQL statements and bypass of query validation and access restrictions through the MCP interface.

A vulnerability was detected in p2r3 convert up to commit 6998584ace3e11db66dff0b423612a5cf91de75b. The Bun.serve function in buildCache.js (API component) allows path traversal via manipulation of the pathname argument. The attack can be initiated remotely and the exploit is publicly available.

In usememos memos up to 0.22.1, the function memos_access_token in src/App.tsx of the UpdateInstanceSetting component allows manipulation of the additionalStyle/additionalScript arguments, causing improper authorization. The attack can be carried out remotely, and the exploit has been made public. The vendor did not respond.

A double-free and use-after-free vulnerability was found in the `IntoIter::drop` and `ThinVec::clear` functions of the thin_vec crate. A panic in `ptr::drop_in_place` skips resetting the length to zero.

In phili67 Ecclesia CRM up to 8.0.0, the ValidateInput function in /v2/query/view/ (Query Viewer component) is vulnerable to SQL injection via manipulation of the custom argument. The attack can be initiated remotely and a public exploit exists. The vendor did not respond to the disclosure.

A vulnerability was detected in Cockpit-HQ Cockpit up to 2.13.5 affecting some unknown functionality of the Asset Handler/Aggregate Handler component. The manipulation results in improper neutralization of special elements in data query logic. The attack can be launched remotely, and the exploit is now public.

Fudo Enterprise versions 5.5.0 through 5.6.2 allow low-privileged users to access administrator-only resources via improperly protected API endpoints, including sensitive information such as system logs and configuration settings. The vulnerability is fixed in version 5.6.3.

A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0 in the Upload function of FileTool.java within the File Upload Endpoint component. Manipulation of the Type argument leads to path traversal. The attack can be launched remotely and the exploit is publicly available.

A flaw was found in langgenius dify up to 1.13.3 affecting the parse_openai_plugin_json_to_tool_bundle function in api/core/tools/utils/parser.py (ApiBasedToolSchemaParser component). Manipulating the url argument leads to server-side request forgery, and the attack can be launched remotely. The exploit has been published.