CVE Vulnerability Catalog

Termix versions 1.8.0 through 2.5.1 allow authenticated users to access the server-stats API without per-host authorization. GET /status, GET /status/:id, and POST /clear-connections expose host state and let a regular user clear the global SSH connection pool. The issue is fixed in version 2.5.1.

LaSuite Doc versions 4.8.2 through 5.4.0, in GET /api/v1.0/documents/search/, accepts sequential seven-digit document paths without requiring the caller to know the public UUID. An unauthenticated attacker can enumerate public document subtrees, obtaining identifiers, titles, creator data, and metadata, while differing 403/404 responses reveal path existence. The issue is fixed in version 5.4.0.

HCL Sametime is vulnerable to insufficient input sanitization. The application did not properly sanitize user input, which is implicitly or explicitly trusted without sufficient validation. Malicious actors can leverage this vulnerability.

A vulnerability was detected in Excalidraw up to 0.18.1 in an unknown function of packages/excalidraw/data/restore.ts within the Imported File Handler component. Manipulating the customData.generationData.html argument leads to cross-site scripting, and the attack can be carried out remotely. The exploit is public and the vendor did not respond to the disclosure.

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (GET /v1/admin/logs/file). The path confinement check uses str.startswith() rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json files outside the configured LOG_FOLDER.

HAVELSAN Inc. Liman Render Engine contains an improper certificate validation vulnerability that allows an Adversary in the Middle (AiTM) attack. This issue affects versions from 1.0 before 1.2-75.

Liman Render Engine contains a key exchange without entity authentication vulnerability, allowing an Adversary in the Middle (AiTM) attack. This issue affects versions from 1.0 before 1.2-75.

IBM Concert versions 1.0.0 through 3.0.0 allow recursive copying of directories without proper controls, which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails.

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.

libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a very large literal or folded block scalar, the function repeatedly grows an internal buffer using alloca() inside a loop. The allocated stack memory is not released until the function returns, causing cumulative stack growth that can exceed the process stack limit and result in SIGSEGV and denial of service.

Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user management module.

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime. An attacker with root access to a partition can send a specially crafted request to the partition firmware runtime, causing it to crash with possible memory corruption.

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is affected by a vulnerability in the partition firmware runtime boot configuration. An attacker with root access to a partition can maliciously alter partition nvram, causing the partition to fail to boot. This condition persists until operator intervention — deleting and recreating the partition configuration — to restore normal operation. Successful exploitation results in an integrity and availability impact.

A vulnerability in the RTAS firmware-to-OS interface of IBM PowerVM Hypervisor. An attacker with administrator-level (root) access to a logical partition can send a specially crafted request to partition firmware, causing the partition to crash and become unavailable. Other partitions on the same managed system are not affected.

An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. An authenticated administrator can create a new service key for the Controller service cluster; because service-key creation is not restricted to the installer-provisioned path, the key is cryptographically indistinguishable from a legitimate one and can be used to forge a service-authentication token impersonating the Controller service. Combined with the gateway OIDC workload-identity endpoint (enabled via FEATURE_OIDC_WORKLOAD_IDENTITY_ENABLED), the attacker can drive the gateway to sign Workload Identity Tokens (WITs) for arbitrary Controller workloads, and a downstream resource server such as HashiCorp Vault that trusts the gateway OIDC key will accept the forged WIT and return the AAP credentials bound to that workload, disclosing secrets beyond the attacker's authorization boundary.

An Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF through 09092026.

A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check individual group visibility permissions. This allows a delegated administrator with basic search privileges to view detailed information about all groups assigned to a role, bypassing intended security restrictions.