CVE Vulnerability Catalog

The vulnerability in Apache Cocoon involves improper restriction of recursive entity references in DTDs (XML entity expansion). XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system.

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.

PIA's token verification (verify_token in pia/oidc.py) fetches the OIDC discovery document of an allowlisted issuer and then follows the jwks_uri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS. An approved identity provider can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext http, from PIA's own network position, before any signature is verified.

A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cross-origin WebSocket request. The vulnerability was patched on 22 July 2026, and no customer action is needed.

A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.

A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.

A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.

A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.

A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.

A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.

A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.

A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content; this requires a page containing the shop's order plugin. Orders that are already paid are not affected.

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.

A weakness has been identified in Osclass up to 8.3.1. Affected is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the Item Model Handler component. Manipulation of the sPattern argument causes SQL injection. The attack may be initiated remotely and the exploit has been made public. The vendor was contacted early but did not respond.

A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0 in an unknown function of the file src/index.ts of the Advanced Search Tool component. Manipulation of the fileType argument results in OS command injection; the attack requires a local approach. The exploit has been released publicly and the real existence of this vulnerability is still doubted.

The download link for files uploaded through a form relied on a predictable token, and the file name in the request was not verified in a guess-resistant way. An unauthenticated attacker could access files uploaded by other visitors; the token was also shown in plain text in the text version of the notification email.