CVE Vulnerability Catalog

Munshi (by Petpooja) before 2026-06-17 contains a broken object level authorization vulnerability that allows authenticated attackers to access another user's purchase inquiry by manipulating the thread identifier in the GET /purchase-inquiry/thread/{thread-id} endpoint. Attackers can read supplier communication and quotation content belonging to other users.

Munshi (by Petpooja) before 2026-07-28 contains a broken object level authorization vulnerability that allows authenticated sub-users to delete invoices belonging to the tenant owner via the DELETE /api/invoice/{invoice_id} and POST /api/invoices/bulk-delete endpoints. The endpoints only verify tenant membership without enforcing object-level ownership or permission checks.

The Joomla DJ-Classifieds extension before 3.11.3 contains an IDOR vulnerability in the "duplicate my ad" feature of the new-ad form. An advert is loaded by its raw numeric ID without verifying that it belongs to the requesting user or whether it is published, blocked, or a pending draft, allowing any logged-in user to retrieve the full content of another user's ad, including contact details and price.

A security vulnerability was detected in AndyFactory newspaper4k up to 0.9.6, affecting the Article.parse function in newspaper/extractors/image_extractor.py (Image Extractor component). Manipulation leads to server-side request forgery, exploitable remotely.

The error handling implementation fails to properly sanitize or validate user-supplied input within URL parameters under specific conditions. This allows end-users to manipulate error messages displayed by the application.

Control Web Panel (CWP) before webpanel_version 1.30 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root. The 'user' parameter is interpolated directly into a query against the oauth_clients table, enabling time-based blind SQL injection and extraction of arbitrary database contents.

wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization, allowing a CREST JSON response to be interpreted as HTML and enabling execution of arbitrary JavaScript in the victim's browser.

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in DataTable embedding. Attackers who can edit pages, including anonymous users under the default configuration, can read repository-internal files by setting an absolute src such as /.git/config and rendering the file as a table.

Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code. Users who can edit pages (including anonymous users under the default configuration) can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that a thread passed by a user-mode, memory-protected module belongs to that module. Any loaded module can suspend, resume, terminate, reset or re-prioritise application threads and other modules' threads and abort their waits.

Chainlit 2.12.0 contains a server-side request forgery vulnerability that lets unauthenticated attackers bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can submit MCP URLs with '..;' segments to the /mcp endpoint, causing requests to paths outside the operator's grant.

Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script via a crafted nowpath parameter to webclient/makethumb.html. Attackers can break out of the directory CDATA section in admin_get_lastconn.html XML to forge a connection id that executes in administrators' browsers.

Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child document via documents.unpublish, retain parentDocumentId, then call documents.update with a private collection UUID to inject phishing content.

LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers can save blocks containing script or event-handler markup that executes in administrator or Superadmin sessions.

Kvazaar through 2.3.2 contains an infinite loop vulnerability in read_header() in src/encmain.c that allows attackers to hang the command-line encoder by supplying a truncated Y4M header. A crafted .y4m file lacking a terminating newline causes unchecked EOF reads that hang the process while consuming a full CPU core.

libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows attackers to bypass a signed bounds check via an overlong fundamental sequence. A crafted CCSDS 121.0/SZIP stream with 2^31 or more zero bits can crash the decoder or leak adjacent memory into decoded samples.

L-SMASH through 2.14.5 contains a heap out-of-bounds write vulnerability in isom_read_hdlr() and isom_read_dref_entry() in core/read.c triggered by oversized box sizes. Crafted MP4 or MOV files declaring hdlr or url box sizes larger than remaining data stall the stream position and corrupt heap memory.

rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Consecutive anchors or tags overflow the fixed two-element annotation array in release builds, corrupting stack memory.

The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. A huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute causes allocation failure and a write through NULL.

libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress(). Malicious USB cameras can supply small allocation-table values and a thumbnail header byte so in-place byte-swapping exceeds the buffer by about 30 KB, leaking heap contents in preview images.