CVE Vulnerability Catalog

Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, the client-side path in authorize does not block all dangerous URL schemes and does not invoke the backend callback allow-list validation, allowing an unauthenticated attacker to redirect a victim browser to an arbitrary HTTP or HTTPS origin for phishing or OIDC error and state smuggling. This issue is fixed in version 2.9.0.

aqua is a declarative command-line version manager written in Go. Prior to 2.60.1, pkg/unarchive/archives.go in the handler.HandleFile method calls os.Symlink without verifying that the target remains under the extraction destination. A later regular-file entry at the same archive path is opened with OpenFile using O_CREATE and O_WRONLY, which follows the attacker-planted symlink. A malicious or compromised package archive can therefore write attacker-controlled bytes outside aqua's extraction directory with the privileges of the user running aqua, potentially overwriting shell startup files, tool configuration, or writable executable paths. This issue is fixed in version 2.60.1.

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route without checking registered plugin IDs before DOM rendering through innerHTML. A crafted URL can execute JavaScript when opened by a user. The script can read data available to the Yamcs web application and perform actions in the user context. This issue is fixed in versions 5.12.8 and 5.13.2.

Yamcs before version 5.9.4 reflects the attacker-controlled redirect_uri parameter from GET /auth/authorize into authorize.html without adequate HTML escaping. A crafted authorization URL can execute JavaScript when opened by a Yamcs user, allowing theft of authentication material and account compromise.

Yamcs before versions 5.12.8 and 5.13.2 omits SystemPrivilege.ControlAccess checks in IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges. Any authenticated account can call GET /api/roles, GET /api/roles/{name}, and GET /api/privileges to enumerate available system privileges and configured role mappings.

Yamcs before versions 5.12.8 and 5.13.2 fails to enforce privileges required by equivalent REST endpoints in WebSocket subscription handlers. Specifically, subscriptions to packets, algorithm status, and mission database changes are available without required privileges, allowing low-privilege users to receive sensitive data.

Graylog from 7.1.0 until 7.1.4 and 7.2.0-alpha.2 allows an authenticated user to request composite display fields in the System Catalog entity titles endpoint without verifying that every selected field is readable. A user can retrieve protected values, including password hashes on readable user records; ordinary users are limited to their own records, while administrators can retrieve hashes for all users.

Vikunja before version 2.4.0 allows mass assignment of the project_view_id value in POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}. The permission check validates that the bucket belongs to the URL project and view but does not validate the destination view in the body, allowing any authenticated user to relocate an attacker-owned bucket into another tenant's Kanban view.

Vikunja from 2.3.0 until 2.4.0 allows a user with Write but not Admin permission on a shared child project to detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The authorization check bypasses the Admin requirement for zero values, allowing bypass of the fix for CVE-2026-35595.

Vikunja from 0.21.0 until 2.4.0 allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project. The permission check in the duplication operation skips the write-permission requirement for the parent project, allowing injection of content into another user's or team's project hierarchy.

Hatchet from 0.40.0 until 0.91.1 does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe. An authenticated owner of any tenant who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker from the dispatcher.

Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getMacFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain MAC filter rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getScheduleCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain schedule or scheduled-reboot configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getStorageCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain storage feature state information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getUPnPCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain UPnP enablement and parsed port-mapping information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getSmartQosCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain Smart QoS configuration and rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getMeshNeighborTable function of TOTOLINK T6 allows unauthenticated attackers to obtain mesh neighbor information via a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getApWiFiSchCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain AP-specific Wi-Fi scheduling rules via a crafted POST request to /cgi-bin/cstecgi.cgi.