CVE Vulnerability Catalog

A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape the intended directory and read and overwrite files on the server via a crafted URL.

An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL.

The Webba Booking plugin (webba-booking-lite) is affected by a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects Webba Booking from an unspecified version through 6.5.4.

RTIR extends RT's HTML scrubber to allow an internal link placeholder and lets through any link containing that placeholder, including links using the executable javascript: scheme. The change applies to the whole RT instance once RTIR is installed, not only RTIR's own queues. Anyone who can add HTML content to a ticket, including an unauthenticated sender of HTML email to the Incident Reports queue (open to everyone by default), can store such a link, and the script runs in the session of the user who clicks it. The issue was fixed in versions 5.0.11 and 6.0.4.

RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a report, rendering that subject without HTML escaping. A ticket subject containing script runs it when a user opens either form. RTIR grants everyone the right to create Incident Reports by default, so an unauthenticated sender of an emailed report can set that subject, and the script runs in the session of the handler who creates or splits the incident. The issue was fixed in version 6.0.4; RTIR 5.0 is not affected.

RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL placed in the link. A URL crafted to break out of the link's address can add a script that runs when the ticket history is displayed, with no further action by the viewer. Anyone who can add HTML content to a ticket, including an unauthenticated sender of HTML email to any queue granting CreateTicket or ReplyToTicket to Everyone, can plant it. The issue was fixed in versions 5.0.11 and 6.0.4.

A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before 0.12, 0.13.0 up to 0.13.17, 0.14.0 up to 0.14.12, 0.15.0 up to 0.15.17 and 0.16.0 up to 0.16.3. The cluster identity claimed by a registration request was accepted without being bound to the registration token that the request was made with. As a result, a registration request could be associated with a managed cluster that was originally registered with a different registration token.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify bitmap and transparency mask dimensions match. Attackers can supply a crafted SVM file with mismatched mask dimensions to trigger heap reads and writes, causing crashes or code execution as the user.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. An attacker can supply a crafted PICT file with manipulated dimensions, causing heap over-reads leading to crashes or heap memory disclosure.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

A deserialization of untrusted data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. The vulnerability was patched on 11 September 2026.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS. This issue affects Blocksy Companion: from n/a through 2.1.60.

In SOCFortress CoPilot prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints omit role and tenant authorization, and the exclusion creation endpoint does not properly validate credentials — any invalid, expired or forged Bearer token can create a suppression rule. Additionally, rules with a null customer_code apply across all tenants, and low-privilege users can list, modify, disable or delete exclusions.

In SOCFortress CoPilot prior to 0.1.77, the POST /api/scoutsuite/generate-gcp-report endpoint passes the raw multipart filename to the file writer without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory, including into the application source directory.

In the ng-antd-admin template prior to 22.0, a hardcoded default JWT secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization and impersonate any user, including administrators.

In SOCFortress CoPilot, the unauthenticated /scoutsuite-report StaticFiles mount exposes the scoutsuite-report directory, disclosing HTML reports and result files containing AWS, Azure and GCP IAM principals, resource inventories and misconfigurations. During a GCP scan, the service-account key is saved into that same web-served directory and removed only after the scan finishes, so an anonymous client can retrieve it.