CVE Vulnerability Catalog

Payload is a free and open source headless content management system. In versions before 3.88.0 and canary versions before 4.0.0-canary.27, an untrusted user who can query a readable collection, control its sorting, and select a protected field as the sort parameter can infer limited information about field values the user cannot read.

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes.

A security flaw has been discovered in vllm-project vLLM up to 0.31.0, affecting the function get_token_bin_counts_and_mask in the file vllm/model_executor/layers/utils.py of the Penalty Handler component. Manipulation results in denial of service. Remote exploitation is possible, and the exploit has been publicly released.

A vulnerability was identified in Kusalkasilva Learning-Management-System up to version ffeb873f8803f1e9664384ff75000c7da45466d2, affecting an unknown function in the file search_class.php. Manipulation of the argument school_year leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

In Microsoft UFO before version 3.0.9, the /api/task_result/{task_name} endpoint calls SessionManager.get_result_by_task() in ufo/server/services/session_manager.py, which acquires a non-reentrant lock and then attempts to acquire the same lock again when the task name maps to a session. An authenticated attacker can block the request indefinitely, and in the default single-process configuration, the blocked event-loop thread prevents other HTTP, WebSocket, and dependent background interactions.

A vulnerability in ESET PROTECT On-Prem involves allocation of resources without limits or throttling, leading to increased CPU and RAM consumption and potentially enabling a Denial-of-Service attack.

In Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, the function django.forms.models.BaseModelFormSet.save_existing_objects() used the presence of a primary key on a submitted form's instance as evidence that the instance belonged to the formset's limiting queryset. An object outside that queryset can be deleted by an authenticated user without permission on the targeted object, via forged management-form data. Models using the default AutoField primary key are not affected.

In Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, an incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document referencing an external raster source.

In Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, the function django.utils.http.parse_header_parameters() is subject to a potential denial-of-service attack due to quadratic time complexity when parsing a value with many separators inside a quoted parameter. An unauthenticated request could reach this parsing through headers such as Accept or Content-Type.

A vulnerability in Expert Mail by Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. involves improper control of interaction frequency, allowing brute force attacks. This issue affects Expert Mail through 2026-09-18.

In Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, the function django.utils.translation.get_supported_language_variant() is subject to a potential denial-of-service attack when processing many distinct, very long language codes, which are retained as keys in an in-memory cache and consume process memory.

A vulnerability in Johnson Controls Illustra Standard - L4L China on Windows involves improper input validation, allowing OS command injection. This issue affects versions before 6.0.0.66394.

Reflected XSS vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack due to improper input neutralization during web page generation. Affects versions through 2026-10-06.

Mooncake Store through 0.3.13.post1 has a missing authorization vulnerability allowing unauthenticated attackers to inject completed LOCAL_DISK replicas via NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replicas pointing at attacker-controlled endpoints to serve poisoned disk-tier reads and fake key existence.

Mooncake Store through 0.3.13.post1 has a missing authorization vulnerability allowing unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.

lrzsz before 0.13.0 has a heap-based buffer overflow in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

libmikmod before 3.3.14 has a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications.

Microsoft UFO prior to 3.0.9 has a vulnerability where authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinned_addresses only to the initial destination. The pinned websockets.connect() client follows cross-origin redirects and opens a new TCP connection before Galaxy performs its post-handshake peer-IP validation, allowing WebSocket upgrade requests to internal hosts reachable from the server. The confirmed impact is the internal connection and handshake request, and does not establish arbitrary HTTP methods, response-body disclosure, a completed AIP session, or cloud metadata access. This issue is fixed in version 3.0.9.

In Microsoft UFO's execute_command tool (linux_mcp_server.py), sort and uniq are treated as read-only commands even though their options allow file output. An authenticated caller can use sort -o or the optional second uniq operand to create or overwrite files writable by the UFO server process without shell metacharacters. The issue is fixed in version 3.0.9.

A Cross-site Scripting (XSS) vulnerability exists in the Forums feature of OpenText Content Management Content Server. A bad actor could inject malicious code into a Forums web page.