CVE Vulnerability Catalog

Joomla! Core - [20260912] - Core - XSS in module list in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The module list layout did not properly escape user supplied values, leading to an XSS vector.

Joomla! Core - [20260911] - Core - XSS in link toolbar layout in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The link toolbar layout did not properly escape inputs, leading to an XSS vector.

Joomla! Core's mail template feature lacks an escaping mechanism, causing XSS vectors in multiple extensions. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core has improper ACL checks in outputs for tagged items. Unauthorized users can view content items from inaccessible categories. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an arbitrary directory deletion vulnerability via the cache purge action. An improper validation of the cache group name allowed path traversals in the file storage of the caching layer, resulting in arbitrary directory deletions.

Joomla! Core lacks escaping in the generic media output layouts, leading to an XSS vulnerability. Affects the generic audio and video output layouts. Affects versions 4.0.0-5.4.8 and 6.0.0-6.1.3.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for access level webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in access level endpoints.

Joomla! Core's profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in the expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

In KubeVirt, an authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment.

Balbooa Forms < 2.4.3.4 contains a file metadata tampering vulnerability. The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath()).

In the Balbooa Forms extension for Joomla (versions below 2.4.3.4), the public removeTmpAttachment action accepts an attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind the attachment ID to the session that uploaded the file, the current user, the form, or the temporary state, allowing any guest to perform unauthorized deletion of attachments.

Stored XSS vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows persistent script injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Stored XSS vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows persistent script injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Stored XSS vulnerability in the Flow extension for MediaWiki due to improper input neutralization during web page generation. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

In urllib3 (versions 2.6.2 through 2.8.0), the HTTPResponse.stream and HTTPResponse.read_chunked methods can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes.

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.

In Devolutions Server 2026.3.5, improper rule enforcement in the PAM Active Directory provider allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. The record layer passes the record length to the cipher before checking it is long enough, causing an internal error instead of treating the record as failed authentication.

A NULL pointer dereference vulnerability in the OpenSSL CMP client. When a client requests certificate revocation based on a PKCS#10 CSR and the server returns a specially crafted certificate name in its response, the client reads from a NULL pointer and crashes. Only clients that identify the certificate via CSR (e.g. 'openssl cmp -cmd rr -csr' or OSSL_CMP_exec_RR_ses() with OSSL_CMP_CTX_set1_p10CSR()) are affected.