CVE Vulnerability Catalog

Cockpit CMS up to version 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability. Unauthenticated attackers can read arbitrary files or execute PHP code by injecting unvalidated PATH_INFO from REQUEST_URI into filesystem path construction without containment checks.

AutoBangumi before version 3.2.8 contains hard-coded default credentials that allow unauthenticated attackers to authenticate as the administrator using publicly known default credentials seeded at startup via add_default_user() in the database user module when the users table is empty.

A double-free vulnerability was found in GIMP's PSP file format parser in the read_layer_block() function. This flaw can lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

A buffer overflow vulnerability has been discovered in the UTT nv518G device running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit the gohead/sub_483ba0 component to cause a denial of service (DoS).

Reflected XSS vulnerability in Netdata before 2.3.1 in the api/v2/ilove.svg and api/v3/ilove.svg endpoints. An attacker can inject malicious JavaScript via the love parameter, which is reflected in the SVG response without proper encoding. The endpoints are accessible without authentication, allowing remote script execution in the victim's browser.

The TinyPNG plugin for WordPress (versions up to 3.6.13) contains an arbitrary file deletion vulnerability exploitable by authenticated attackers with author-level access or higher. The issue stems from insufficient file path validation in the delete_converted_image_size function.

Eclipse Wakaama before snapshot/2026-05-26 has an unbounded memory allocation vulnerability in the CoAP Block1 handler in coap/block.c. An unauthenticated remote attacker can send a sequence of Block1 PUT requests with incrementing block numbers, causing repeated reallocation of an accumulation buffer without a maximum size limit, leading to server memory exhaustion and denial of service.

A vulnerability in CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 is due to improper verification of cryptographic signatures. This allows an attacker with physical access to upload arbitrary malicious firmware without authentication.

A stored XSS vulnerability was found in the web management interface of Archer C5 v6.8 routers due to insufficient input validation and output encoding. An admin can inject malicious HTML/JS that executes when another admin views the affected page.

Vulnerability in the Erlang/OTP ssl application. An unauthenticated attacker can send a crafted TLS 1.3 ClientHello, crashing the session ticket handler and making TLS 1.3 unusable until the ssl application is restarted.

TOCTOU race condition in the ssl module (dtls_packet_demux) in Erlang/OTP. An unauthenticated remote attacker can send multiple ClientHello messages from the same source, causing a race and crash of the demux process, terminating all active DTLS sessions on that listener. The attack is repeatable and requires no authentication.

Vulnerability in Erlang/OTP ssl module (tls_gen_connection) allows a network attacker to inject unauthenticated plaintext that the TLS client treats as authenticated server data. Affects OTP from 17.0 before 29.0.3, 28.5.0.3, and 27.3.4.14.

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute a valid DTLS cookie before the first rotation of the cookie secret.

An infinite loop vulnerability in the ssh_sftpd module of Erlang/OTP SSH allows an authenticated SFTP user to permanently block an SFTP channel. By sending extended data (SSH_MSG_CHANNEL_EXTENDED_DATA) with a non-zero type code, the attacker causes the handle_data/4 function to loop indefinitely, preventing further message processing on that channel.

A vulnerability in the ssh_sftpd module of the SSH server in OTP (Erlang) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The issue stems from improper path handling in the SSH_FXP_REALPATH handler, which does not canonicalize the path before checking restrictions.

Craft CMS versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without the required delete permission. The vulnerability is in the actionMoveFolder() function of the AssetsController.

Craft CMS versions 5.7.0 through 5.9.20 contain a mass-assignment vulnerability in the bulk-duplicate element action. An attacker who can duplicate their own entries can submit an arbitrary id via the newAttributes parameter, leading to overwriting an existing victim entry.

Missing validation of 'valuesFrom' references in Helm Deployer of SUSE Rancher Fleet allows owners of one tenant to access fleet credentials of other tenants. Affected versions: 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.15.

Landray OA contains an unauthenticated HQL injection vulnerability that allows attackers to query Hibernate entities by injecting malicious HQL syntax into the uid parameter of the wechatLoginHelper.do endpoint. Lack of input sanitization in the filter expression passed to the Hibernate findList() method enables extraction of sensitive data like administrator password hashes and, with sufficient database privileges, file-write operations leading to remote code execution.

Redsea Cloud eHR contains an arbitrary file upload vulnerability that allows unauthenticated attackers to achieve remote code execution by uploading malicious files through the PtFjk.mob servlet endpoint. Attackers can submit a multipart POST request with a JSP webshell disguised using a spoofed image/jpeg Content-Type to bypass the absence of extension and MIME type validation, with the uploaded file stored at a predictable path under the uploadfile directory and executed directly by the web server.