CVE Vulnerability Catalog

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.

Dell iDRAC9, 14G versions prior to 7.00.00.182 and 15G/16G versions prior to 7.20.30.50, contains an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to gaining access to unauthorized data.

libjpeg-turbo 3.2.0 contains an integer division-by-zero vulnerability in the PNG loader. When processing a valid indexed-color PNG image with a non-gray palette through tj3LoadImage12() or tj3LoadImage16() using the default pixel format, the application may trigger a division-by-zero in alloc_sarray(), causing a SIGFPE and denial of service.

Winter CMS up to version 1.2.12 contains a vulnerability that allows authenticated backend users to disclose arbitrary files readable by the PHP process by injecting @import directives into LESS source. The flaw is due to the LESS parser being instantiated without a safe import resolver. Fixed in version 1.2.13.

Fleet prior to version 4.87.0 contains a vulnerability in the target search endpoint (POST /api/latest/fleet/targets) that returns unmasked team enroll secrets and full team configuration, including credential-bearing agent options, to low-privilege observer-class users. Fixed in version 4.87.0.

Fleet prior to version 4.85.0 contains a vulnerability in the global policy read endpoint (GET /api/latest/fleet/policies/{policy_id}) that fails to verify team ownership of the requested policy, allowing an authenticated user with observer-level access on any single team to read the full details of policies belonging to any other team. Fixed in version 4.85.0.

Winter CMS up to version 1.2.12 contains a vulnerability in the backend FileUpload form widget that trusts an attacker-controlled file_id POST parameter when resolving the attachment, allowing an authenticated backend user to read and modify attachment records belonging to other users or records. Fixed in version 1.2.13.

Missing Authentication for Critical Function vulnerability in Spring Cloud Config allows unvalidated Webhook requests to the /monitor endpoint. Affects versions from 5.0.0 through 5.0.4, from 4.3.0 through 4.3.4, from 4.0.0 through 4.2.8, and through 3.1.14.

Winter CMS up to and including 1.2.12 did not enforce per-template-type permission checks in the Theme Editor, allowing a backend user with any single CMS permission to act on template types outside their scope. Additionally, the AssetList widget allowed unauthorized file uploads into the active theme's asset directory.

Winter CMS up to and including 1.2.12 is vulnerable to SQL injection in the backend Filter widget via the numberrange scope type when configured with a conditions key, allowing an authenticated backend user to inject arbitrary SQL. Exploitation requires a third-party plugin to have registered such a filter.

Netmaker disables certificate verification on the connection to the configured mail server. The skip-verify field is set to true unconditionally, allowing the client to accept any certificate, including one from an interposing party. Mail sent by Netmaker includes password-reset messages with single-use tokens and user invitations with enrolment links, which can be intercepted.

Automatisch reveals whether an address is registered through the response to its forgot-password request. The route is mounted without authentication and without rate limiting, allowing account enumeration.

Mage AI does not confine the paths accepted by its browser-items API to the project directory. A user with the Viewer role, which grants read access within the project, can read any file the server process can read by supplying an absolute path. Users with the Editor role can also write outside the project directory.

ZLMediaKit confines the downloadFile API to configured root directories with a prefix comparison that does not account for directory boundaries. A requested path is accepted if it starts with the configured root, allowing reading files from similarly named directories. The API secret is required, but the reference container runs the server as root.

DebugKit for CakePHP applications has a vulnerability in the MailPreview feature that allows an attacker to execute arbitrary class constructors. The attack requires access to DebugKit with debug mode enabled and an allowed hostname.

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contain a CSRF vulnerability in cmd.cgi. The double-submit cookie protection can be bypassed when no Cookie header is present by supplying matching NagFormId and nagFormId values in the POST body.

Nagios Core before 4.5.12 contains a CSRF vulnerability in cmd.cgi where the CSRF protection passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as an authenticated user.

Starlette-Admin before 0.16.1 does not validate user-supplied order_by and structured where field names against the configured sortable_fields and searchable_fields allowlists. An authenticated user can sort or filter on unintended fields, leading to limited information exposure and potential HTTP 500 errors.

The IEEE 1588 PTP management-message parser in subsys/net/lib/ptp/tlv.c mishandles the PTP_MGMT_TIME management id. It fails to validate the TLV data length before reading and writing a 10-byte ptp_timestamp structure, causing an out-of-bounds read and write of 8 bytes. The vulnerability is reachable by an adjacent attacker on the local PTP segment when CONFIG_PTP is enabled.

The Seattle FilmWorks plugin in GIMP has a vulnerability involving unbounded stack allocation of a variable-length array when processing a specially crafted SFW file. This leads to an application crash and denial of service.