CVE Vulnerability Catalog

In Xiaopi Panel 1.0.0, manipulation of the param argument in the /demo.php file of the WAF Firewall component leads to cross-site scripting. Remote exploitation is possible, the exploit is publicly available and might be used, and the vendor did not respond to the disclosure.

In SourceCodester Simple Customer Relationship Management System 1.0, manipulation of the Description argument in the /create-ticket.php file of the Create Ticket component causes cross-site scripting. Remote exploitation is possible, and the exploit has been publicly disclosed and may be utilized.

IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.

IBM Verify Identity Access Container 11.0–11.0.2, IBM Security Verify Access Container 10.0–10.0.9.1, IBM Verify Identity Access 11.0–11.0.2, and IBM Security Verify Access 10.0–10.0.9.1 contain an open redirect vulnerability that could allow a remote attacker to conduct phishing attacks by redirecting a victim to arbitrary websites via a crafted request.

Iperius Backup up to 8.7.2 is affected by use of a hard-coded cryptographic key in the IperiusAccounts.ini file. The attack requires local access and high complexity, and a public exploit is available.

A dangling pointer flaw was found in libinput. It occurs when a garbage collection cleanup function is called, leaving a pointer that can then be printed to system logs. This could potentially expose sensitive data if the memory location is re-used. Exploitation requires Lua plugins to be enabled in libinput and loaded by the compositor, and the ability to deploy a plugin file in specific system directories.

A security vulnerability has been detected in welovemedia FFmate up to 2.0.15. An unknown functionality of /ui/app/components/AppJsonTreeView.vue, within the Webhook Handler component, is affected. Manipulation leads to cross site scripting, the attack may be initiated remotely, and the exploit has been publicly disclosed.

The SonicWall Email Security appliance has a vulnerability due to improper input sanitization that may lead to data corruption. A remote authenticated attacker with admin privileges can exploit this by providing crafted input that corrupts the application database.

SonicWall Email Security has a DoS vulnerability due to improper input validation, exploitable by a remote authenticated admin user.

In Sulu, an open-source PHP CMS based on Symfony, versions 1.0.0 through 2.6.22 and 3.0.0 through 3.0.5, a user with permission for the Sulu Admin via at least one role could access sub-entities of contacts via the admin API without having permission for contacts.

A vulnerability was found in Nautobot before versions 2.4.30 and 3.0.10 where password validation is not enforced when creating or editing users via the REST API. Weak passwords may be set.

A cross-site scripting vulnerability was found in SourceCodester Leave Application System 1.0 in the User Management Handler component. Remote attack is possible. Exploit is publicly available.

Discourse, an open-source discussion platform, has a vulnerability in a sentiment analytics endpoint. An authenticated moderator-level user can retrieve post content, topic titles, and usernames from unauthorized categories. The issue is fixed in versions 2026.1.3, 2026.2.2, and 2026.3.0.

Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. The attack requires administrative user privileges and extensive access rights, with low impact on confidentiality and no impact on integrity.

go-git is a pure Go Git implementation library. Prior to version 5.17.1, the index decoder for format version 4 fails to validate the path name prefix length before applying it to the previously decoded path name. A maliciously crafted index file can trigger an out-of-bounds slice operation, resulting in a runtime panic during normal index parsing. This issue only affects Git index format version 4; earlier formats (v2 and v3) are not vulnerable.

OpenClaw before 2026.3.11 has a credential fallback vulnerability where unavailable local tokens are treated as unset, allowing fallback to remote credentials in local mode. Attackers can exploit misconfigured local auth references to bypass intended authentication boundaries.

When the internal webserver is enabled (default is disabled), an attacker might trick an administrator into visiting a malicious website and extract configuration information. The root cause is a misconfigured CORS policy.

An attacker can inject HTML content into the internal web dashboard by sending crafted DNS queries to a DNSdist instance with domain-based dynamic rules enabled.

An incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the promises API without the required permission checks, while their callback-based equivalents (`fs.fchmod()`, `fs.fchown()`) were correctly patched. As a result, code running under `--permission` with restricted `--allow-fs-write` can still use promise-based `FileHandle` methods to modify file permissions and ownership on already-open file descriptors, bypassing the intended write restrictions. This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model.

A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync.native()` without the required read permission checks, while all comparable filesystem functions correctly enforce them. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync.native()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects 20.x, 22.x, 24.x, and 25.x processes using the Permission Model.