CVE Vulnerability Catalog

Missing Authorization vulnerability in ThemeOne The Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Grid: from n/a through 2.8.0.

Beam beta9 v0.1.521 contains a Directory Traversal vulnerability. A remote attacker can obtain sensitive information via the joinCleanPath function.

A path traversal vulnerability exists in TMS Management Console 6.3.7.27386.20250818 from TMS Global Software. The 'Download Template' function in the profile dashboard does not neutralize directory traversal sequences (../) in the filePath parameter, allowing authenticated users to read arbitrary files, such as the server's Web.config.

Podatność CVE-2025-4763 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie Hotel Guest Hotspot firmy Aida Computer Information Technology Inc. Umożliwia to ataki typu Reflected XSS.

Discord through 2026-01-16 allows gathering information about whether a user's client state is Invisible (and not actually offline) because the response to a WebSocket API request includes the user in the presences array with "status": "offline", whereas offline users are omitted. This is inconsistent with the UI description of Invisible as "You will appear offline." A third-party report suggests this was remediated later in 2026.

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to version 2.3.1, a compromised or misconfigured TUF repository can have the configured value of signature thresholds set to 0, which effectively disables signature verification. This can lead to unauthorized modification of TUF metadata files at rest or during transit as no integrity checks are made. Version 2.3.1 fixes the issue. As a workaround, always ensure that TUF metadata roles are configured with a threshold of at least 1.

go-tuf is a Go implementation of The Update Framework (TUF). Starting in version 2.0.0 and prior to 2.3.1, if the TUF repository (or any mirror) returns invalid TUF metadata JSON (valid JSON but not well-formed TUF metadata), the client panics during parsing, causing denial of service. The panic occurs before signature validation, so a compromised repository/mirror/cache can DoS clients without any signing key.

Stored XSS vulnerability in Argo Workflows allows arbitrary JavaScript execution in another user's browser via artifact directory listing. Affects versions prior to 3.6.17 and 3.7.8.

The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes. The issue permits deletion of properties but does not allow overwriting their original behavior. The issue is patched from 4.17.23 to 4.18.0 depending on the package: lodash, lodash-es, and lodash-amd in 4.17.23, and the standalone lodash.unset and lodash.omit packages in 4.18.0.

A vulnerability in the Linux kernel causes a system panic when copying sk_buff.cb data to userspace via sock_recv_errqueue. The issue stems from the skbuff_fclone_cache lacking a usercopy whitelist, triggering a BUG() when CONFIG_HARDENED_USERCOPY is enabled. The fix uses a local stack variable as a bounce buffer to bypass the hardened usercopy check.

W jądrze systemu Linux zidentyfikowano podatność, która prowadzi do dereferencji wskaźnika NULL podczas dezaktywacji nieaktywnych agregatów w funkcji qfq_reset. Problem występuje, gdy dwa obiekty qfq_class wskazują na ten sam leaf_qdisc, co może prowadzić do błędów w zarządzaniu kolejkami.

User-controlled header names and values containing newlines can allow injecting HTTP headers. This may lead to manipulation of HTTP responses or requests.

In http.cookies.Morsel (Python), user-controlled cookie values and parameters can allow injecting HTTP headers into messages. The patch rejects all control characters within cookie names, values, and parameters.

The imaplib module in Python allows injection of additional commands via newline characters in a user-supplied command. Mitigation rejects commands containing control characters.

The urllib.request.DataHandler module in Python parses user-controlled data URLs, allowing header injection through newlines in the data URL mediatype.

When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis was not preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.

A vulnerability in Chainlit versions prior to 2.9.4 allows an authenticated attacker to read arbitrary files on the server by manipulating the path in a project element update request. The attacker can copy the file to their session and then retrieve it using the element identifier.

hexpm (hex.pm) has a Cross-Site Scripting (XSS) vulnerability in the Elixir.HexpmWeb.SharedAuthorizationView module. The render_grouped_scopes/3 function does not sanitize input, allowing script injection.

In node-tar library up to version 7.5.2, the linkpath of Link (hardlink) and SymbolicLink entries is not sanitized when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets.

CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.