CVE Vulnerability Catalog

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in User Submitted Posts allows Stored XSS. Affects versions from n/a through 20260810.

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.

MISP contains a stored XSS vulnerability in the galaxy icon handling path. The icon field is persisted without server-side validation and later concatenated into HTML by correlation graph rendering scripts. A user with perm_galaxy_editor can store arbitrary HTML/JavaScript that executes in another user's browser when viewing the correlation graph.

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink when the value passes FILTER_VALIDATE_URL, which accepts javascript: URIs. A user with galaxy editor privileges can store a javascript: URL, and when another user clicks it, the script executes in their browser.

LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated SSRF. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.

GPAC up to 26.07.0 has a buffer overflow vulnerability in the function gf_dash_resolve_url in src/media_tools/dash_client.c of the DASH Client component. The attack can be carried out remotely. Upgrading to version abi-16.26 resolves the issue.

A vulnerability was identified in Artifex Ghostscript up to 10.07.0 in the function type1_callsubr of the file devices/vector/gdevpsfx.c of the Pdfwrite component. The manipulation leads to a stack-based buffer overflow, and remote exploitation is possible. The exploit is publicly available and might be used.

Blosc C-Blosc2 up to 3.3.2 has an integer overflow vulnerability in the function blosclz_decompress in blosc/blosclz.c of the blosclz Decompression component. The attack can be launched remotely but is difficult to exploit. Upgrading to version 3.3.3 fixes the issue.

Astro from 5.2.0 to 8.2.4 has a vulnerability in the @astrojs/netlify adapter that generates regexes for Netlify Image CDN remote-image allowlists without anchoring them to the URL start. This allows an attacker to control the actual host while an allowed origin appears only in the path or query. An unauthenticated request to /.netlify/images can cause the Image CDN to request attacker-selected URLs, potentially probing internal services. Fixed in version 8.2.4.

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.

GraphicsMagick up to 1.3.47 has an uncontrolled recursion vulnerability in the function ExtractPostscript in coders/wpg.c of the WPG File Handler component. The attack can be initiated remotely. The patch is named 627b5b1b2fc2.

The MPG plugin in versions up to and including 4.2.3 allows an unauthenticated user to access sensitive data. The lack of required authentication enables exposure of confidential information.

The Cool Formkit Lite plugin in versions up to and including 2.7.8 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of a malicious script into the site.

The Razorpay Payment Links for WooCommerce plugin in versions up to and including 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF) without requiring authentication. An unauthenticated attacker can force a victim to perform unwanted actions.

The King Addons for Elementor plugin in versions up to and including 51.1.86 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.

The YITH WooCommerce Tab Manager plugin in versions up to and including 2.15.0 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Author privileges. This allows injection of a malicious script into the site.

The OAuth Server plugin in versions up to and including 4.5.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.

The Strong Testimonials plugin (up to version 3.3.11) has a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.