CVE Vulnerability Catalog

In the Statamic CMS, the `user:reset_password_form` tag could render user input directly into HTML without escaping, allowing an attacker to craft a URL that executes arbitrary JavaScript in the victim's browser.

Statamic (a Laravel and Git powered CMS) before versions 5.73.16 and 6.7.2 allows manipulation of the markdown preview endpoint to return data from arbitrary fieldtypes. An authenticated control panel user could retrieve sensitive user data including email addresses, encrypted passkey data, and encrypted two-factor authentication codes; fixed in 5.73.16 and 6.7.2.

A cross-site request forgery (CSRF) vulnerability was identified in SourceCodester Note Taking App up to version 1.0, affecting an unknown function. The attack can be carried out remotely, and a public exploit is available.

Varnish Cache before 8.0.1 and Varnish Enterprise before 6.0.16r12, in certain unchecked req.url scenarios, mishandle URLs with a path of / for HTTP/1.1. This may lead to cache poisoning or authentication bypass.

Prior to 4.81.0, Fleet contained an issue in the user invitation flow where the email address provided during invite acceptance was not validated against the email address associated with the invite. An attacker who obtained a valid invite token could create an account under an arbitrary email address while inheriting the role granted by the invite, including global admin. Version 4.81.0 patches the issue.

Home Assistant, an open source home automation platform, contains a cross-site scripting vulnerability in the "remaining charge time" sensor for mobile phones (imported from Android Auto). The issue affects versions from 2025.02 prior to 2026.01 and is fixed in version 2026.01.

Home Assistant, open source home automation software, from version 2020.02 and prior to 2026.01 allows an authenticated party to add a malicious name to their device entity, enabling cross-site scripting attacks against anyone who sees a dashboard with a Map-card including that entity. Requires the victim to hover over an information point. Version 2026.01 fixes the issue.

LibreChat is a ChatGPT clone with additional features. In versions 0.8.2-rc1 through 0.8.3-rc1, user-created MCP servers can include arbitrary HTTP headers that undergo credential placeholder substitution. An attacker can create a malicious MCP server with headers containing {{LIBRECHAT_OPENID_ACCESS_TOKEN}} (and others), causing victims who call tools on that server to have their OAuth tokens exfiltrated. Version 0.8.3-rc2 fixes the issue.

LibreChat versions 0.8.2-rc2 through 0.8.2-rc3 do not verify that the requesting user owns the SSE stream. Any authenticated user who knows a valid stream ID can read another user's real-time chat content.

A SQL injection vulnerability was discovered in code-projects Social Networking Site 1.0 within the file delete_photos.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely, and the exploit has been released to the public.

WWBN AVideo versions up to and including 26.0 contain get_api_video_file and get_api_video API endpoints that return full video playback sources (direct MP4 URLs, HLS manifests) for password-protected videos without verifying the video password. An unauthenticated attacker can retrieve direct playback URLs for any password-protected video by calling the API directly.

Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.

A Cross-Site Request Forgery (CSRF) vulnerability was determined in SourceCodester Diary App 1.0 within the file diary.php. Input manipulation can lead to unauthorized actions on behalf of the user. The attack may be launched remotely, and the exploit has been publicly disclosed.

A flaw has been found in itsourcecode Free Hotel Reservation System 1.0 in /admin/mod_room/index.php?view=edit, where manipulation of the ID argument leads to SQL injection. The attack can be launched remotely and the exploit has been published.

WWBN AVideo versions up to and including 26.0 contain a Time-of-Check-Time-of-Use (TOCTOU) race condition in the transferBalance() method in plugin/YPTWallet/YPTWallet.php. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, resulting in only one deduction while the recipient is credited multiple times.

WWBN AVideo up to and including 26.0 has a categories.json.php endpoint that fails to enforce user group-based access controls. In the default request path group filtering is skipped, exposing all non-private categories, and with the ?user= parameter a type confusion bug uses the admin user's (user_id=1) groups instead of the current user's. Commit 6e8a673eed07be5628d0b60fbfabd171f3ce74c9 contains a fix.

Wazuh version 4.12.0 contains a vulnerability exposing the GITHUB_TOKEN in GitHub Actions workflow artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.

In huggingface smolagents 1.25.0.dev0, the evaluate_augassign, evaluate_call, and evaluate_with functions in local_python_executor.py are vulnerable to code injection. A public exploit exists, and the vendor did not respond.

A vulnerability in Appsmith versions prior to 1.98 exposes sensitive instance management API endpoints without authentication. Unauthenticated attackers can query endpoints like /api/v1/consolidated-api/view and /api/v1/tenants/current to retrieve configuration metadata, license information, and unsalted SHA-256 hashes of admin email domains.

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the verifyTokenSocket() function in plugin/YPTSocket/functions.php has its token timeout validation commented out, causing WebSocket tokens to never expire despite being generated with a 12-hour timeout. This allows captured or legitimately obtained tokens to provide permanent WebSocket access, even after user accounts are deleted, banned, or demoted from admin. Admin tokens grant access to real-time connection data for all online users including IP addresses, browser info, and page locations. Commit 5d5237121bf82c24e9e0fdd5bc1699f1157783c5 fixes the issue.