CVE Vulnerability Catalog

In the systeminformation library for Node.js before 5.33.14, the Linux `networkStats(iface)` implementation uses the caller-supplied interface value in an `fs.existsSync()` check and to build `/sys/class/net/<iface>` paths without verifying it is a single interface-name segment or that the resolved path stays under `/sys/class/net`. An attacker controlling `iface` can use parent-directory components and symlink traversal to make the API return the first line of a file readable by the Node.js process. This requires local filesystem setup; the issue is fixed in 5.33.14.

A vulnerability in the Tidewave library allows an attacker to read filesystem path names of the application via Tidewave configuration through /tidewave/connect or the rendered toolbar. The responses do not check the Host header, so a web page that rebinds its own domain to the loopback address can read the tag with a same-origin request that carries no Origin header. The paths usually reveal the local username and project layout.

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, LTS2026 versions 8.6.1.0 through 8.6.1.20, contain a Relative Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information tampering.

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer, which can cause the application to crash and may affect data integrity.

@fastify/session in all releases before 11.1.6, with the default rolling session behavior, allows a request that restored a session before a logout to save its own copy after another request completed the session destroy call, recreating the destroyed session identifier with its authenticated data. An attacker holding a victim's valid signed session cookie can replay it to restore the session after it was meant to be revoked, without cookie theft or signature forgery.

darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses.

A vulnerability in Vaadin applications using server push (@Push). The push endpoint reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, enabling any origin to make a cross-origin request with the user's cookies and read the response. Reading useful data also requires the session's push identifier.

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.

A vulnerability in the qs library causes the key of an empty array to be written without encoding when allowEmptyArrays: true is used, even though keys are encoded by default. A key containing &, =, or # can therefore inject parameters into the serialized query string or truncate it. Affected versions are >=6.12.0 <6.12.6, >=6.13.0 <6.13.4, >=6.14.0 <6.14.3, >=6.15.0 <6.15.4, and >=6.16.0 <6.16.2.

The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty. This allows unauthenticated attackers to forge webhook notifications and mark arbitrary WooCommerce orders as paid on web servers that preserve request header case.

A cross-site scripting vulnerability exists in HR-Payroll-Management-System (Saruf-Ratul) in chat.php via manipulation of the ID argument. The attack can be launched remotely and a public exploit is available.

A cross-site scripting vulnerability exists in Online-Payroll-Management-System (MD-MAFUJUL-HASAN) in chat.php via manipulation of the ID argument. The attack can be launched remotely and a public exploit is available.

A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in TextField.vue via manipulation of the text argument. The attack can be executed remotely and a public exploit is available.

A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in Sandbox.vue via manipulation of the template argument. Remote exploitation is possible and a public exploit is available.

A cross-site scripting vulnerability exists in Argilla up to 2.8.0 in SettingsInfo.vue (Settings Page) via manipulation of the Name argument. The attack can be launched remotely and a public exploit is available.

flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causing an out-of-bounds read before the buffer and crashing the process.

flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal point to generated parsers, crashing applications when the buffer ends at an unmapped page.

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read past the heap block buffer.

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.

Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory.