CVE Vulnerability Catalog

In Tautulli prior to version 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string using manual escaping that does not handle backslashes. A backslash-quote sequence can terminate the string, allowing an unauthenticated attacker to execute script in the Tautulli web context when an authenticated user follows a crafted link.

jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the GET /tenant/info endpoint. Attackers can iterate the primary key to enumerate and access sensitive tenant data including login names, validity dates, user quotas, and enabled state across all platform tenants.

jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-permission definitions. Attackers can supply arbitrary roleId and btnStr parameters to overwrite button-permission configurations for any role in the tenant without privilege validation.

jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.

In Warpgate prior to version 0.28.4, the PUT /@warpgate/admin/api/users/:id/roles/:role_id endpoint does not require AdminPermission::AccessRolesAssign. A limited administrator with any permission can update expires_at on an existing UserRoleAssignment and clear revoked_at, extending an expiring grant or reinstating a revoked grant.

Warpgate up to version 0.27.6 has a vulnerability in the browser SSH path where the jump host key is stored for the target address. In Prompt and AutoAccept modes, a machine presenting the jump host key at the target address can be accepted as the target, allowing interception of user traffic and a newly issued certificate when certificate authentication is used. The native SSH path is unaffected because it tracks each hop separately. This issue is fixed in version 0.27.6.

Warpgate up to version 0.27.3 has a vulnerability in HTTP API token authentication where token validation does not enforce the owning user's allowed_ip_ranges against the trusted client address. An attacker holding a leaked, phished, or exfiltrated X-Warpgate-Token can use it from a prohibited network location. Deployments without allowed_ip_ranges are unaffected, and other paths (HTTP target proxying, SSH, MySQL, PostgreSQL, RDP, VNC, Kubernetes) do not accept this vulnerable HTTP token flow. This issue is fixed in version 0.27.3.

Dell Command | Integration Suite for System Center versions prior to 6.7.2 contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

Dell Command | Intel vPro Out of Band versions prior to 4.7.2 contain an Incorrect Default Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

Warpgate prior to version 0.25.6 has a vulnerability in the HTTP proxy where a client-supplied x-warpgate-username header is forwarded before the authenticated username is appended. Because the request builder preserves repeated values, a proxied backend that trusts the first value can authorize an authenticated attacker as another user. The same forwarding policy also accepts the reserved x-warpgate-authentication-type header. This issue is fixed in version 0.25.6.

InvenTree prior to version 1.4.0 has a vulnerability in WeasyPrint report rendering where privileged users can cause retrieval of attacker-selected resources via HTTP, HTTPS, or local file URI schemes. The lack of a restricted url_fetcher allows reading local files or internal HTTP responses, enabling full-read SSRF, arbitrary local file disclosure including application credentials, and possible compromise of a superuser account. This issue is fixed in version 1.4.0.

InvenTree prior to version 1.4.0 has a vulnerability in the /api/report/print/ and /api/report/label/print/ endpoints, which require authentication but do not check per-model view permissions before selecting objects and rendering them with a chosen template. A role-less or unrelated-role account can enumerate object identifiers and download reports containing purchase, sales, part, BOM, stock, build, supplier, customer, pricing, and inventory data that the corresponding detail APIs would deny. This issue is fixed in version 1.4.0.

InvenTree prior to version 1.4.0 has a vulnerability in the /api/importer/row/ and /api/importer/mapping/ endpoints, which do not scope querysets to the owner of the associated import session. Any authenticated user, including an account with no assigned roles, can supply another user's import session identifier and retrieve that session's row_data and data fields together with its column mappings. This exposes the full contents of data staged for import across users. This issue is fixed in version 1.4.0.

InvenTree prior to version 1.4.0 has a vulnerability in plugin settings endpoints, which lack the IsAuthenticated permission. An unauthenticated caller can retrieve plugin names, setting keys, descriptions, types, choices, and non-protected configuration values. Protected secret values remain masked, limiting the issue to metadata and non-secret configuration disclosure. This issue is fixed in version 1.4.0.

InvenTree prior to version 1.4.0 has a vulnerability in the /api/barcode/ endpoint, which accepts an attacker-synthesized internal JSON barcode containing a lowercase model label and integer primary key. The endpoint requires only authentication or a general read scope, and the built-in barcode plugin returns the complete model serializer output without checking the caller's per-model view role. A low-privilege user can enumerate primary keys for parts, stock, locations, supplier and manufacturer parts, orders, and builds to disclose commercially sensitive data. This issue is fixed in version 1.4.0.

An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single transfer buffer permanently unsubmitted, defeating the bounds check in usbredirhost_iso_packet() and allowing a usbredir peer to write past the end of the packet descriptor array on every subsequent isochronous packet.

Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a user with edit permission but without entity ownership to include a shareRequest that grants owner permissions to an arbitrary account. The selected account can then delete the saved search or dashboard or remove the original owner's access. Graylog Cloud was patched before the advisory was published. This issue is fixed in versions 6.3.14, 7.0.9, and 7.1.4.

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py uses IsAuthenticatedOrReadScope without requiring the ADMIN role used by other machine management operations. Any authenticated user who lacks the ADMIN role, including a warehouse user with only the STOCK role, can cause MachineRestart to invoke registry.restart_machine() for any registered machine, resetting its status and interrupting active printing, scanning, or other machine operations. This issue is fixed in version 1.4.0.

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to version 0.4.108, the SSRF guard `validateServerUrl` (added for CVE-2026-33060, extended for CVE-2026-53509) validates only the hostname string and never resolves DNS. Any caller-supplied `server_url` whose hostname *resolves* to an internal address passes the guard, so the server issues requests to loopback and cloud metadata (`169.254.169.254`). This is a third bypass of the same guard, and it reaches IMDS — strictly more than CVE-2026-53509, which only reached loopback. Version 0.4.108 contains an updated fix.

HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/sys/validate/notifier_url.go do not inspect IPv4 destinations embedded in the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An authenticated user can submit a generic:// notifier through POST /v1/notifiers or POST /v1/notifiers/test, and on a Homebox instance that egresses through NAT64/DNS64, the gateway can translate an accepted IPv6 destination to cloud metadata, localhost, or another internal IPv4 host. The notifier test path returns delivery result information, and Shoutrrr propagates the response, providing feedback that can disclose retrieved metadata such as temporary credentials. Without NAT64 egress, the crafted IPv6 destination is not routable, but the guard still incorrectly classifies it as safe. This issue is fixed in version 0.26.0.