CVE Vulnerability Catalog

CI4MS is a CodeIgniter 4-based CMS skeleton. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within System Settings – Company Information. Several administrative configuration fields accept attacker-controlled input that is stored server-side and later rendered without proper output encoding.

CI4MS, a CodeIgniter 4-based CMS skeleton, prior to 0.31.0.0 fails to properly sanitize user-controlled input in System Settings – Social Media Management. Fields such as Social Media and Social Media Link accept attacker-controlled input stored server-side and later rendered without proper output encoding.

Multiple D-Link devices (including DNS-120, DNS-320, DNS-323, DNS-345, DNR-326) up to 20260205 have a vulnerability in disk management functions in /cgi-bin/dsk_mgr.cgi. Manipulation leads to improper access controls and the attack can be launched remotely. The exploit is publicly available.

IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. An attacker may obtain cookie values by sending a user an http:// link or planting it on a visited site; the cookie is sent over the insecure link and can be captured by snooping traffic.

IBM Verify Identity Access Container and IBM Security Verify Access Container versions 10.0 through 10.0.9.1 and 11.0 through 11.0.2 return certificate listings as a JSON payload but incorrectly set the Content-Type header to text/html. Browsers may interpret the JSON data as executable script, enabling JavaScript injection and potential cross-site scripting (XSS).

Flask-HTTPAuth prior to version 4.8.1 invokes the token verification callback with an empty string when the client makes a request without a token or with an empty token. If any user in the application database has an empty string as their token, the request could be authenticated as that user.

AIOHTTP (asyncio/Python) prior to version 3.13.4 allowed multiple Host headers in requests. The issue has been patched in version 3.13.4.

AIOHTTP prior to version 3.13.4 allows an attacker who controls the reason parameter when creating a Response to inject extra headers or perform similar exploits. The issue has been patched in version 3.13.4.

AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python, prior to 3.13.4 drops the Authorization header when following redirects to a different origin but retains Cookie and Proxy-Authorization headers. This may leak credentials to another origin. The issue is patched in 3.13.4.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.

In aiohttp prior to version 3.13.4, an attacker who controls the content_type parameter could inject extra headers or perform similar exploits. The issue has been patched in version 3.13.4.

IBM Security Verify Access and IBM Verify Identity Access contain a vulnerability due to inconsistent interpretation of HTTP requests by a reverse proxy. This could allow a remote attacker to access sensitive information.

IBM Security Verify Access and IBM Verify Identity Access contain a vulnerability due to inconsistent interpretation of HTTP requests by a reverse proxy. This could allow a remote attacker to access sensitive information.

IBM DataPower Gateway 10.6CD 10.6.1.0 through 10.6.5.0, 10.5.0 10.5.0.0 through 10.5.0.20, and 10.6.0 10.6.0.0 through 10.6.0.8 could disclose sensitive system information from other domains to an administrative user.

IBM Aspera Shares versions 1.9.9 through 1.11.0 use weaker than expected cryptographic algorithms, which could allow an attacker to decrypt highly sensitive information.

A security flaw was discovered in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The Webdav_Access_List function in /cgi-bin/file_center.cgi is affected; manipulation of the cmd argument results in improper access controls, and the attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location.

Payload, a free and open source headless CMS, before version 3.79.1 contains a Cross-Site Request Forgery (CSRF) vulnerability in the authentication flow. Under certain conditions, the configured CSRF protection could be bypassed, allowing cross-site requests. The issue is patched in version 3.79.1.

In Mbed TLS through 4.0.0, a compiler-induced timing side channel (in RSA and CBC/ECB decryption) occurs only with LLVM's select-optimize feature. TF-PSA-Crypto through 1.0.0 is also affected.

A vulnerability in ChangeDetection.io before version 0.54.7 allows bypassing protections in the SafeXPath3Parser. Attackers can read arbitrary local files using unblocked XPath 3.0/3.1 functions like json-doc().