CVE Vulnerability Catalog

The Cyber-III Student-Management-System has an XSS vulnerability in the file /admin/class%20schedule/delete_batch.php. Manipulation of the batch argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.

In Vim, the zip.vim plugin before version 9.2.0280 contains a path traversal bypass that allows overwriting arbitrary files when opening specially crafted zip archives. This vulnerability circumvents the previous fix for CVE-2025-53906.

Ajenti before version 2.2.15 allows an authenticated user (using the auth_users plugin) to install a custom package even if not a superuser. This vulnerability is fixed in version 2.2.15.

Chyrp Lite prior to version 2026.01 has an IDOR/Mass Assignment issue in the Post model. Authenticated users with post editing permissions can modify other users' posts by passing internal class properties like id into the post_attributes payload.

Hugo, a static site generator, from 0.60.0 to before 0.159.2, links and image links in the default markdown to HTML renderer are not properly escaped. Hugo users who trust their Markdown content or have custom render hooks for links and images are not affected. This vulnerability is fixed in 0.159.2.

Tandoor Recipes before 2.6.4 allows authenticated users to inject arbitrary <style> tags into recipe step instructions. The bleach.clean() sanitizer explicitly whitelists the <style> tag, causing the backend to persist and serve unsanitized CSS payloads via the API. Any client consuming instructions_markdown from the API and rendering it as HTML without additional sanitization will execute attacker-controlled CSS — enabling UI redressing, phishing overlays, visual defacement, and CSS-based data exfiltration.

An information disclosure vulnerability in AZIOT 1 Node Smart Switch (16A) with firmware version 1.1.9 is caused by improper access control on the UART debug interface. An attacker with physical access can connect to the UART interface and obtain sensitive information from the serial console without authentication.

Ascertia SigningHub User v10.0 contains an open redirect that allows attackers to redirect users to a malicious site via a crafted URL.

In Cyber-III Student-Management-System, the move_uploaded_file function in /AssignmentSection/submission/upload.php allows unrestricted file upload via manipulation of the File argument. The attack can be initiated remotely and a public exploit is already available.

In whisperX API versions 0.3.1 to 0.5.0, FileService.download_from_url() calls requests.get(url) with zero URL validation. The file extension check occurs after the HTTP request is made and can be bypassed by appending .mp3 to any internal URL. The /speech-to-text-url endpoint is unauthenticated.

An authenticated stored XSS vulnerability exists in the creation/editing module of Feehi CMS v2.1.1. Attackers can inject malicious JavaScript or HTML into the Content field, which executes in other users' browsers.

A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection.

A vulnerability was detected in code-projects Online FIR System 1.0. An unknown functionality of the /complaints.sql file in the SQL Database Backup File Handler component results in insecure storage of sensitive information. The attack may be performed remotely and the exploit is publicly available.

Workbench, a suite of tools for administrators and developers to interact with Salesforce.com organizations via the Force.com APIs, prior to 65.0.0 contains a reflected cross-site scripting vulnerability via the footerScripts parameter, which does not sanitize user-supplied input before rendering it in the page response. Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Workbench allows XSS Targeting Error Pages.

A DoS vulnerability in vLLM from version 0.1.0 to before 0.19.0 allows an unauthenticated attacker to block the asyncio event loop and cause Out-Of-Memory crashes by sending a single HTTP request with an astronomically large n parameter in ChatCompletionRequest and CompletionRequest models.

A vulnerability in vLLM from version 0.7.0 to before 0.19.0 allows an attacker to send a single API request with thousands of base64-encoded JPEG frames, causing the server to decode all frames into memory and crash with OOM. The issue is due to missing frame count limit in the VideoMediaIO.load_base64() method.

In OpenEXR versions 3.2.0 to 3.2.7, 3.3.9, and 3.4.9, a vulnerability exists in the DWA lossy decoder. For sufficiently large image widths, 32-bit arithmetic overflow causes writes outside the allocated rowBlock buffer.

OpenEXR from 3.2.0 to before 3.2.7, 3.3.9, and 3.4.9 has a signed integer overflow in undo_pxr24_impl() in src/lib/OpenEXRCore/internal_pxr24.c. The expression (uint64_t)(w * 3) computes w * 3 as a signed 32-bit integer before casting, which may allow the bounds check to pass incorrectly and cause writes beyond the allocated buffer. This is fixed in 3.2.7, 3.3.9, and 3.4.9.

OpenEXR from 3.4.0 to before 3.4.9 has a missing bounds check on the dataWindow attribute in EXR file headers, allowing an attacker to trigger a signed integer overflow in generic_unpack(). Setting dataWindow.min.x to a large negative value causes an enormous image width and an overflowing multiplication, terminating the process with SIGILL via UBSan. This is fixed in 3.4.9.

A memory corruption vulnerability occurs when accessing freed memory due to concurrent fence deregistration and signal handling. The race condition leads to a use-after-free scenario.