CVE Vulnerability Catalog

Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories.

Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows low-privileged authenticated users to bypass the role-based Media permission. Attackers can POST to /admin/media/upload to store files, read private media via download_private_file, and use crop with saved_avatar to change other users' avatars.

PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML files with image extensions via /share/v1/common/file/upload. Attackers can lure administrators to /static-file/<key>?a=.pdf, bypassing the nginx attachment header to serve HTML inline and steal the panda_wiki_token JWT for session takeover.

MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retrieve the private template content of every user on the instance.

OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user parameter into the file path, which the portal forwards with its server API key, to read files in private model, code or space repositories.

Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated users to subscribe to other users' private channels by supplying arbitrary channel names. Attackers can request a signature for private-chatify.<victim id> via POST /chat/auth to receive the victim's incoming private messages and attachments in real time.

Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in Codestar backup AJAX actions csf-export, csf-import and csf-reset. Shop Managers can read the csf_backup_nonce from the settings page and supply arbitrary option names via the 'unique' parameter to read, overwrite or delete WordPress options, including modifying wp_user_roles to escalate to administrator.

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without releasing the Module Manager mutex when a module preamble declares a data or stack size that overflows the allocation arithmetic. Loading such an image blocks every later module load, start, stop and unload from other threads until the system is reset.

inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of at least INI_MAX_LINE-1 bytes followed by a NUL byte, causing undefined behavior reported by memory sanitizers.

Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via the RA (Registration Authority) User Interface. This allows a remote user, authenticated with a valid client certificate, to renew their certificate even if the end entity status and/or profile settings should deny renewal. The attacker must have a valid TLS client certificate, and must be authorized to use the RA User Interface, either with the certificate, or via a role membership for PublicAccessAuthenticationToken.

Inventory Tracking Application by Starnet Computer and Network Systems contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions through 2026-10-16.

Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration. An authenticated non-administrative user can bypass document ownership restrictions by searching for and linking another user's private document ID to their own warranty, enabling unauthorized read access to private documents via the shared Paperless-ngx API credential.

Apache Syncope contains an incomplete fix for CVE-2026-77051 — an SQL injection vulnerability via unsanitized opEvent parameters. An administrator with adequate entitlements can execute arbitrary SQL through stacked queries.

Apache Syncope has an improper isolation or compartmentalization vulnerability. An administrator with adequate entitlements for Implementations can create a malicious Groovy class that runs untrusted code on a separate thread, bypassing the Groovy security sandbox.

Apache Syncope has an authorization bypass through a user-controlled key vulnerability. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination.

The Apache Arrow Rust crate (`arrow`) from version 33.0.0 through 57.3.1, 58.4.0, 59.3.1 and 60.0.0 has an out-of-bounds read vulnerability. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array.

Apache Syncope has an improper privilege management vulnerability. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication.

Apache Syncope has an improper isolation or compartmentalization vulnerability. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process; when a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server with no sandbox.

Helix Ultimate extension for Joomla (versions < 2.2.11) contains a Stored XSS vulnerability in the Mega Menu Badge Text field. Malicious HTML/JS can be stored and executed in the user's browser.

StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a Reflected XSS vulnerability. Malicious JavaScript can be reflected in the server response and executed in the victim's browser.