CVE Vulnerability Catalog

HCL BigFix AEX is affected by a clickjacking vulnerability, which could allow an attacker to embed the application within a malicious web page or iframe and trick users into performing unintended actions, potentially leading to unauthorized transactions or changes to their accounts.

HCL BigFix AEX is affected by a Server-Side Request Forgery vulnerability, which could allow an attacker to cause the application to send unauthorized requests to external resources. Successful exploitation could lead to access to unintended services, sensitive information disclosure, or unauthorized actions through the affected application.

HCL BigFix AEX is affected by a Remote Code Execution (RCE) vulnerability. An attacker may execute code with the privileges of the affected application or service, potentially leading to unauthorized access, data exposure, or system compromise.

HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. An attacker could upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the MongoDB storage adapter's parseWhere silently drops the field rather than rejecting the request, producing an empty filter that matches all users, and the password is verified against the first user (the administrator). This is a partial authentication bypass that removes the email factor for the administrator account, enables user enumeration, and amplifies credential-stuffing.

HCL BigFix AEX is affected by a vulnerability in the aws-sdk package. It may cause AWS API requests to be sent to unintended or non-AWS endpoints.

In Progress Telerik Document Processing Libraries prior to version 2026.3.1027, improper verification of cryptographic signatures and improper certificate validation in RadPdfProcessing digital signature validation allow an unauthenticated attacker to cause signature validation to report forged content as unmodified and its signing certificate as valid via a crafted signed PDF document.

In Progress Telerik Document Processing Libraries prior to version 2026.3.1027, an XML external entity reference vulnerability in SVG image processing allows an unauthenticated attacker to read local files on the server via a crafted SVG image with a nested embedded SVG, when the image is processed or exported to PDF.

In Progress Telerik Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files where they are writable, via relative file paths that resolve against the process current working directory.

In Progress Telerik Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, unchecked loop condition and inefficient regular expression vulnerabilities in RadSpreadProcessing and RadSpreadStreamProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted XLSX or XLS workbook or formula.

In Progress Telerik Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, infinite loop, inefficient algorithmic complexity and resource allocation vulnerabilities in RadPdfProcessing and AI document summarization and question answering allow an unauthenticated attacker to terminate or hang the host process via a crafted PDF document or document text submitted for summarization or question answering.

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, uncontrolled recursion, inefficient algorithmic complexity and infinite loop vulnerabilities in RadWordsProcessing allow an unauthenticated attacker to terminate or hang the host process via a crafted DOCX, DOC, RTF or HTML document.

Redux Framework by David Anderson has a missing authorization vulnerability that allows lifting sensitive data embedded in cache. The issue affects versions up to and including 4.5.16.

Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Optima Express: from n/a through 9.0.0.

Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection. This issue affects Accordion: from n/a through 2.3.25.

Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection. This issue affects GS Logo Slider: from n/a through 3.8.9.

The WP Discussion Board plugin has a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 2.6.0.

Topluyo Desktop for Linux prior to version 2026.9.2410 unsafely processes user-controlled URLs, leading to OS Command Injection via the openExternalLinks() routine in utils.js. An attacker who controls a target URL can execute arbitrary operating system commands with the privileges of the user running the application upon opening the link. Version 2026.9.2410 patches the issue.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.13.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Stored XSS. This issue affects GetPaid: from n/a through 2.8.62.