CVE Vulnerability Catalog

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/{provider} appended the provider, token, and error values before redirecting the victim's browser without validating the destination. Because the one-use token was not bound to the browser session that initiated login, an attacker who induced a victim to complete OIDC authentication could capture the token at the attacker-controlled destination and exchange it through /auth/oidc/callback/{provider} for the victim's Kyoo session. This issue is fixed in version 5.1.0.

In Kyoo media server prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. Path handling only checked the Settings.SafePath prefix and did not verify a Kyoo catalog record, allowing retrieval of hidden, temporary, or uncataloged files under the media directory when the path was known or guessed.

In Paymenter prior to 1.5.7, doUpgrade() relied on Service::upgradable to check for a pending upgrade and then incremented credit without a DB transaction or lock. An authenticated customer with an active downgradable service could submit concurrent downgrade requests, creating multiple upgrade records and incrementing the same credit balance multiple times.

In c-ares prior to 1.34.7, ares_dns_parse() trusted attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming the DNS response contained enough bytes. A malicious DNS response could cause disproportionate heap allocation for a tiny message, degrading or denying name resolution.

In AnyIO prior to 4.14.2, process-pool workers were started with stderr connected to a pipe the parent never drained. Worker code writing enough data to sys.stderr could fill the pipe and block before returning the response, causing the awaiting process-pool call to remain blocked indefinitely.

A flaw was found in Netty's HTTP/2 stack that allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting.

In the Self Update Handler component of spatie Scotty up to version 1.4.2, there is a vulnerability where code is downloaded without an integrity check. The SelfUpdater::update function allows remote exploitation.

In the Doctor Command Handler component of spatie Scotty up to version 1.4.4, there is an OS command injection vulnerability via the host argument. The DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions allow remote attack.

The Grandstream GWN7660ELR device before firmware version 1.0.27.6 contains an information disclosure vulnerability. An unauthenticated remote attacker can query the SNMP v2c service configured with the default community string 'public' to retrieve detailed system information.

In cockpit-ws, there is a denial-of-service (DoS) vulnerability. A remote unauthenticated attacker can send a specially crafted request that, when WebService.UrlRoot is configured and the exact URL-root prefix is requested without a trailing slash, causes the service to terminate unexpectedly.

Semantic MediaWiki versions 7.0.0 through 7.1.0 contain a reflected XSS vulnerability in Special:Ask. The 'cursor' parameter is unsigned and fully attacker-controlled; insufficient validation leads to raw HTML injection into the page.

Prior to version 7.2.0, query debug output (format=debug or the 'debug' parameter on Special:Ask) in Semantic MediaWiki is assembled as raw HTML without proper output-context encoding, leading to reflected XSS.

Prior to version 7.2.0, Semantic MediaWiki's Special:URIResolver redirects to a URL derived from the subpage without validating the target, allowing an open redirect to an off-host destination, potentially embedding credentials.

Prior to version 7.2.0, Semantic MediaWiki reflects the 'value' parameter in rendered output and error messaging paths without sufficient output-context encoding, allowing reflected XSS.

Prior to version 7.2.0, Semantic MediaWiki inserts the separator (parameter 'sep') verbatim into HTML cell joins, allowing HTML injection and potentially XSS.

Prior to version 7.2.0, when headers=plain is set, Semantic MediaWiki emits table header text into <th> via a raw HTML path. User-controlled 'mainlabel' content can become executable HTML.

Process Compose before version 1.120.0 has a vulnerability in the MCP SSE listener that accepts browser-origin requests without validating Host/Origin headers or authenticating the caller. A malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests, potentially allowing process enumeration, log access, and process control if expose_control_tools is enabled. Fixed in version 1.120.0.