CVE Vulnerability Catalog

Weblate prior to version 2026.7 allows a user with the "Edit source" role to store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. This issue is fixed in version 2026.7.

Weblate prior to version 2026.7 allows an authenticated user with access to a project to retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. This issue is fixed in version 2026.7.

Weblate prior to version 2026.7 does not enforce two-factor authentication (2FA) requirements for site-wide global permissions, even though a team can require 2FA for its members. A user belonging to a team with 2FA enforcement receives global permissions without 2FA configured, potentially including access to the site management interface. This issue is fixed in version 2026.7.

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.

A vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges because the content parameter is directly concatenated to the ProcessBuilder.

Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components.

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain a UNIX Symbolic Link (Symlink) Following vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Script injection.

Static Web Server (SWS) is a production-ready web server suitable for static web files or assets. Through 2.43.0, instances with both basic-auth and metrics features enabled process the /metrics endpoint before the basic-auth check in src/handler.rs, allowing an unauthenticated remote attacker to retrieve Prometheus metrics that disclose virtual host names, request volumes, error rates, latency distributions, and active connections. This issue is fixed in version 2.44.0.

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Dell PowerProtect One, versions 20.1.0.0 and below, contain an Authorization Bypass Through User-Controlled Key vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

Dell Cloud Disaster Recovery, versions 20.2 and prior, contain a Server-Side Request Forgery (SSRF) vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.

Vulnerability in Oracle Java SE (component: 2D). Supported versions that are affected are Oracle Java SE: 7u511. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 6.5 (Availability impacts).

Dell PowerProtect One, versions 20.1.0.0 and below, contain a Reliance on Insufficiently Trustworthy Component vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Cache poisoning.

Dell PowerProtect Cyber Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

In specific scenarios involving WebSocket handshake redirects to a different origin, the Reactor Netty WebSocket client may leak credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects. Affected versions: Reactor Netty 1.3.0 - 1.3.6, 1.1.0 - 1.2.18, and 1.0.52 and earlier.

In specific scenarios, the Reactor Netty HTTP Server may leak exception details across unrelated requests. This requires Brave Tracing to be configured. Affected versions are 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.

Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Affected versions include Spring Security 5.7.0 through 7.1.0.

Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources. Affected versions are 3.0.0 through 4.1.0.

Fleet up to version 4.84.1 contains a vulnerability in the Apple MDM commands listing endpoint (GET /api/v1/fleet/mdm/apple/commands) that allows an authenticated user with the Observer role to extract sensitive values such as host enrollment secrets and APNs tokens via a sort-order oracle. An attacker can manipulate the order_key parameter and use binary search to reconstruct values character by character. Fixed in version 4.84.2.

Fleet up to version 4.84.1 contains a vulnerability in the labels host-listing endpoint (GET /api/v1/fleet/labels/{id}/hosts) that allows an authenticated user with the Observer role to extract host enrollment secrets via a sort-order oracle. An attacker can manipulate the order_key parameter and reconstruct node_key or orbit_node_key, enabling host impersonation. Fixed in version 4.84.2.