CVE Vulnerability Catalog

The Simple Cloudflare Turnstile plugin in versions up to and including 1.42.1 is vulnerable to Content Injection that can be performed by an unauthenticated attacker. This allows unwanted content to be placed in the site's context.

The Sierra Wireless HL78xx modem GNSS driver contains a type confusion bug — the gnss_nmea0183_match_data struct is not the first member of hl78xx_gnss_data, so the NMEA parser callbacks (GGA/RMC/GSV) read and write data at a shifted offset. As a result, the GSV callback performs a write through an uninitialized pointer with a garbage bound, potentially causing a kernel crash (DoS) and, on MMU-less targets, adjacent-memory corruption.

MISP version ≤2.5.45 contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which renders MISP element references (attributes, objects, and tags) into inline HTML during PDF report export. User-controlled fields (attribute type and value, object name and relation, tag name and colours) are interpolated into HTML templates without HTML entity encoding. Additionally, the attribute() method contains hardcoded sample values ("domain-ip" and "google.com") instead of format placeholders, causing every plain attribute reference in a PDF to display the sample text rather than the actual indicator value.

EspoCRM before 10.0.4 is vulnerable to server-side request forgery. HostCheck::ipAddressIsNotInternal(), which validates outbound URLs to block requests to internal/private IP addresses, strips ::ffff: (IPv4-mapped IPv6) prefixes but does not recognize IPv6 transition addresses that embed private IPv4 addresses: NAT64 (64:ff9b::), 6to4 (2002::), and Teredo (2001:0000::). An attacker who controls a domain with AAAA records pointing to such transition addresses can bypass both the internal-host validation and the CURLOPT_RESOLVE IP-pinning check, causing EspoCRM to issue outbound requests to internal network services.

Snipe-IT's predefined kit checkout path does not enforce Full Multiple Company Support (FMCS) tenant isolation on the checkout target. Unlike the single, bulk, API, accessory, license and consumable checkout paths, App\Services\PredefinedKitCheckoutService never calls $item->canCheckoutTo($target); it only performs the actor-vs-item policy check and an availability check before persisting the checkout. With FMCS enabled, a non-superuser who belongs to at least two companies and holds the assets.checkout permission can POST to /kits/{kit}/checkout with a user_id belonging only to company B and have a company-A asset (and likewise kit licenses, consumables and accessories) assigned to that user, bypassing the company-mismatch check. The issue is fixed in Snipe-IT 8.7.2.

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard. An authenticated organization member can make the server connect to any address reachable from it, and the resulting HTTP status is persisted as an error message, providing a scanning oracle for internal hosts, ports and paths.

Renovate versions before 44.3.1 (and Mend Renovate CE/EE images before 15.4.0, mend-renovate-ce Helm chart before 15.4.0, mend-renovate-enterprise-edition Helm chart before 10.4.0) do not apply the internal minimumReleaseAge (stability age) checks to digest updates. When a repository configures minimumReleaseAge and has dependencies with updateType=digest (e.g., GitHub Actions pinned to a commit SHA, Docker images, Go modules, NuGet packages), Renovate still opens a pull request for a newly published digest, marked only with a pending renovate/stability-days status check.

Traefik versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11 do not apply the entryPoints.<name>.transport.respondingTimeouts settings (notably readTimeout, enabled by default at 60s) to the HTTP/3 request path. readTimeout is enforced as a deadline on the underlying TCP connection, which cannot be applied to a QUIC stream, and Traefik's HTTP/3 server is constructed without any timeout. As a result, an unauthenticated remote client can trickle request body bytes and hold a request open indefinitely.

AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the APIName=video response. Video rows include columns joined from the video owner's user record, and API::get_api_video() calls removeSensitiveUserFields() only when the caller is neither authenticated nor using a valid API secret; it never compares User::getId() with the row's users_id. As a result, any low-privilege authenticated account can request another user's video and receive the owner's email address, account name (user), and isAdmin, canUpload, and canStream flags.

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) contains a cross-site request forgery vulnerability in the CustomizeUser plugin's plugin/CustomizeUser/setSubscribers.json.php endpoint. The script reads users_id and ExtraSubscribers from $_REQUEST and calls User::setExtraSubscribers() without requiring a POST request or a valid CSRF token; autoCSRFGuard() is applied only to POST requests to *.json.php, and the mutation does not pass through ObjectYPT::save()/isUntrustedRequest(), so a cross-origin GET succeeds. An unauthenticated remote attacker who induces a logged-in administrator to load a crafted page (e.g., an <img> tag pointing at the endpoint) can forge the ExtraSubscribers count displayed on any user's channel.

Capgo fails to clean up channel permission overrides when a user's last organization role binding is deleted, leaving stale overrides active. Attackers can retain channel-specific permissions after their base RBAC access has been revoked to perform unauthorized actions like changing production OTA versions.

A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/electron/src/main/lib/file-preview-service.ts of the File Preview Service component. Manipulation of the file_path argument leads to path traversal. Local access is required to approach this attack, and the exploit has been disclosed publicly and may be used. Upgrading to version 0.19.52 addresses this issue (patch b7bf78ab74b1552c92fc98c7db9a8a8d92c631df).

Suricata is a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. Starting in version 8.0.0 and prior to version 8.0.5, when Lua rule execution is enabled, the Lua sandbox memory limit was not consistently enforced for new allocations. Certain Lua allocation patterns could exceed security.lua.max-bytes without triggering the intended memory limit, making the configured sandbox limit unreliable. This requires Lua rules to be enabled and an affected Lua script/rule to be loaded.

LIBRID/LIBREF by Ankaref Innovation and Technology Inc. has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions from 2.01.0.2183 before 18.9.26.2319.

LIBRID/LIBREF by Ankaref Innovation and Technology Inc. has a stored XSS vulnerability due to improper input neutralization during web page generation. Affects versions from 2.01.0.2183 before 18.9.26.2319.

Observable response discrepancy vulnerability in DernekPlus Website Template allows Account Footprinting. This issue affects Website Template: through 10092026. The vendor was contacted early about this disclosure but did not respond in any way.

cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validates the cookie name and value against character sets that reject the semicolon separator, but the domain and path options are checked only against a permissive RFC 7230 field-content matcher that allows semicolons, and both are written into the Set-Cookie header unescaped. An application that passes untrusted or request-derived data into the domain or path option can therefore inject additional cookie attributes, overriding SameSite, Secure, HttpOnly, or Domain on the cookies the application issues. This is a Set-Cookie attribute injection issue (CWE-74). The issue is fixed in cookies 0.9.2, which validates domain and path against RFC 6265 character sets. As a workaround, keep domain and path application-set rather than derived from untrusted input.

Some Hikvision intercom products utilize an immutable factory value obtainable from local network or physical interaction, which may allow attackers to forge a legitimate main card and gain permission to issue cards.

Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.

DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticate directly to the ticket system API. This allows an attacker to perform privileged operations beyond what is offered by the application, including reading and modifying tickets.