CVE Vulnerability Catalog

Emissary prior to 8.39.0 interpolated configuration-controlled link values directly into href attributes in Mustache navigation templates without URL scheme validation. An administrator able to modify the navItems configuration could inject javascript: URIs, enabling stored XSS against other authenticated users viewing the Emissary web interface.

LinkAce prior to 2.5.4 does not check for private IPs in LinkRepository::update and CheckLinksCommand::checkLink. An authenticated user can read responses from internal services (AWS IMDSv1, cloud metadata, internal APIs) by creating a link with a public URL and then updating it to a private IP; the links:check cron job makes the request server-side without IP filtering. This can expose cloud credentials, internal service data, and network topology. The vulnerability is fixed in 2.5.4.

Nest, a framework for building scalable Node.js server-side applications, prior to 11.1.18 interpolates message.type and message.id directly into Server-Sent Events text protocol output in SseStream._transform() without sanitizing newline characters (\r, \n). Since the SSE protocol treats these as field delimiters, an attacker able to influence these fields can inject arbitrary SSE events, spoof event types, and corrupt reconnection state.

In Kedro-Datasets prior to 9.3.0, PartitionedDataset is vulnerable to path traversal because partition IDs are concatenated directly with the base path without validation. A malicious partition ID containing .. components can cause files to be written outside the configured directory, potentially overwriting arbitrary files.

In Pi-hole FTL (FTLDNS) from 6.0 to before 6.6, CLI sessions intended to be read-only could import Teleporter archives via /api/teleporter and overwrite configuration. This is an authorization bypass, fixed in 6.6.

text-generation-webui prior to 4.3 contains an unauthenticated path traversal vulnerability in load_prompt() that allows reading any .txt file on the server filesystem. The file content is returned verbatim in the API response.

A native messaging host vulnerability in Pega Browser Extension (PBE) affects users of all versions of Pega Robotic Automation who have installed PBE. A malicious website could contain code targeting PBE and present an unexpected message box if a user navigates to it.

Nokia MantaRay NM is vulnerable to a Relative Path Traversal vulnerability due to improper validation of input parameter on the file system in Software Manager application.

An issue in the runZero Platform that could allow a credential to be updated and used for a task outside the authorized organization scope has been resolved. This is CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium).

runZero Explorer contains an Incorrect Authorization issue (CWE-863) that could allow access to Explorer groups outside the authorized organization scope. The issue was fixed in version 4.0.260208.0.

An issue that could allow an authorized user to view clear-text secrets for a subset of credential types and fields has been resolved in the runZero Platform. This is an instance of CWE-522: Insufficiently Protected Credentials, with an estimated CVSS score of 5.3 (Medium). The issue was fixed in version 4.0.260204.2.

An issue in runZero Platform that allowed administrators to create and update users outside their authorized organization scope has been resolved. This is an instance of CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium). The issue was fixed in version 4.0.260203.0.

An issue in the runZero Platform that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved. This is CWE-613: Insufficient Control of Resources After Expiration or Release, with an estimated CVSS score of 5.9 (Medium).

An issue in the runZero Platform that allowed MCP agents to access remediation and asset information outside the authorized organization scope has been resolved. This is CWE-863: Incorrect Authorization, with an estimated CVSS score of 5.8 (Medium).

A SQL injection attack vector related to saved queries (introduced in version 4.0.260123.0) was identified in the runZero Platform. This is an instance of CWE-89: Improper Neutralization of Special Elements used in an SQL Command, with an estimated CVSS score of 6.4 (Medium). The issue was fixed in version 4.0.260123.1.

text-generation-webui before 4.3 has an unauthenticated path traversal vulnerability in load_preset() that allows reading any .yaml file on the server filesystem. Parsed YAML key-value pairs (including passwords, API keys, connection strings) are returned in the API response. Fixed in 4.3.

text-generation-webui prior to 4.3 has an unauthenticated path traversal vulnerability in load_template() allowing reading files with .jinja, .jinja2, .yaml, or .yml extensions from anywhere on the server filesystem. For .jinja files content is returned verbatim; for .yaml a parsed key is extracted. Fixed in 4.3.

In go-ipld-prime prior to 0.22.0, the DAG-CBOR decoder uses collection sizes declared in CBOR headers as Go preallocation hints without capping them. Small payloads can cause excessive memory allocation.

In Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30, the MultiPartParser allows remote attackers to degrade performance by submitting multipart uploads with Content-Transfer-Encoding: base64 containing excessive whitespace. Earlier unsupported Django series may also be affected.

The Ocean Extra plugin for WordPress (through version 2.5.3) contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels.