CVE Vulnerability Catalog

asteval, a Python expression evaluator for restricted execution, prior to 1.0.9 allows sandbox escape. With numpy enabled, the default Interpreter exposes a ctypes type and permits from_address memory access, while attribute assignments use unfiltered setattr. An attacker-controlled expression can read or corrupt process memory, execute code, or disclose secrets.

The vulnerability in Xen concerns the GNTTAB_cache_flush operation, where the error path after adding a NULL check fails to drop a page reference if the page is owned by a special system domain (DOM_IO or DOM_COW).

Electron applications on macOS using Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper prior to 39.8.10, 41.10.5, and 42.0.0-beta.2. The helper did not bind the validated update target to one canonical application-bundle path, allowing a local attacker to redirect the root-level write and overwrite another application's files.

Axios versions 1.15.0 through 1.20.0 incorrectly treat NO_PROXY CIDR entries as textual hostname suffixes instead of network ranges. A request to an address covered by a CIDR entry in NO_PROXY is not matched and is sent through the configured proxy. For plaintext HTTP the proxy can observe and modify URLs, headers, and bodies; for HTTPS it can observe connection metadata and CONNECT requests.

The vulnerability in ProPhoenix Law RMS version v2022.2403.3.101 is a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint.

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.

Listed NETGEAR router models have insufficient input validation in the time server (NTP) setting. An attacker connected to the router's local network with administrator credentials can run unauthorized commands on the router. This impacts router integrity, with no impact on confidentiality or availability.

SFTPGo prior to 2.7.5 allows an authenticated SSH user to send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified.

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated but low-privilege SNMP user can invoke mapped backend operations as an administrative identity. In route_mapper/account.lua, get_user_privilege returns the complete nine-privilege set for a special_users group that includes the SNMPv1_v2c pseudo-user.

MCP Context Forge versions 0.2.0 through 0.3.1 store a prompt template without sufficient output encoding before rendering in the MCP Admin UI. An authenticated attacker can save markup with script-capable event handlers that execute when another user views the saved prompt. This enables stored XSS, interface alteration, phishing, keystroke observation, and actions in the victim's browser session.

InstallShield version 2025 R2 and earlier has a potential privilege escalation issue when running a compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches Setup.exe with Prerequisites from an unsecured location, the Prerequisite installers may also load from an unsecured location, potentially leading to privilege escalation.

Listed NETGEAR Extender models have insufficient session randomness. A network-adjacent attacker with network access (such as WiFi credentials) can predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

NETGEAR R7300 router has insufficient input validation in the LAN Setup feature. An authenticated administrator connected to the local network can perform unauthorized actions on the router. This was identified in a controlled research environment using a simulated version of the router software and has not been confirmed on physical production devices.

An insufficient input validation vulnerability exists in the PPPoE Setup feature of the NETGEAR R7300 router, allowing authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions.

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents.

Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Prior to 3.0.0, the password change endpoint (POST /current/user/password) accepts a valid client token without requiring the account's current password or another elevated authentication step. An attacker who obtains a client token can set a new password for the associated user, taking control of password authentication and forcing account recovery through an administrator or direct database access.

ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.3, 4.0.3, and 4.1.4, applications that allow the SVG animate or set elements can retain an animation whose attributeName targets href and whose value uses the javascript scheme. The sanitized SVG can therefore create a script-bearing link, and a user who clicks the link can execute attacker-controlled script in the application's origin, enabling stored cross-site scripting.

A Server-Side Request Forgery (SSRF) in the serviceURL parameter of ProPhoenix Law RMS v2022.2403.3.101 allows attackers to force the application server to make unintended DNS and web requests via a crafted HTTP request.

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files.