CVE Vulnerability Catalog

Plesk has a vulnerability involving improper symlink resolution before file access, allowing remote authenticated users to execute arbitrary code as root.

Plesk versions 18.0.79.7 and earlier, and 18.0.80 through 18.0.80.3, have an insecure direct object reference vulnerability, allowing remote authenticated users to read and modify other customers' databases.

A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.

LimeSurvey Community Edition 7.0.5+260623 contains an authenticated reflected Cross-Site Scripting vulnerability in the user activation confirmation endpoint. The 'action' query parameter is copied into the response and inserted into a hidden input attribute without HTML attribute encoding.

Wings (the server control plane for Pterodactyl) versions up to and including 1.13.2 do not enforce a server's disk quota during an SFTP transfer, allowing a tenant with SFTP write access to exhaust the host node's physical disk and take down every server on it. Available space is checked only once, when the write handle is opened, using a stale cached value and without knowing the size of the incoming data.

LibreNMS versions from 21.6.0 up to 26.5.0 are vulnerable to command injection in the Signal alert transport because the signal-cli path and the Recipient field are insufficiently escaped before being passed to an exec call. An authenticated administrator can execute arbitrary OS commands on the LibreNMS host.

Simple Machines Forum (SMF) through 2.1.7, fixed in commit 6f0dc61, contains an authorization state-confusion vulnerability in the profile loader that allows authenticated low-privileged users to gain administrator access by supplying multiple values for the user parameter. Attackers can exploit the mismatch between Profile::$member and User::$me->is_owner during sequential profile loading to be treated as the owner of an administrator profile, enabling unauthorized password changes and full account takeover.

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message.

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a malicious AMQP broker can force the client to allocate resources and process content body frames exceeding the frame_max limit. This can lead to unexpected memory consumption or application-layer DoS, bypassing protocol constraints. Version 1.13.0 contains a fix. No workarounds are known.

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage.

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath.

Weblate is a web-based continuous localization platform. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without confining them to the repository. This is an incomplete fix for CVE-2026-34242, allowing arbitrary file read. A user with project-admin privileges can disclose file contents on the host. Fixed in 2026.7.

Weblate is a web-based continuous localization platform. In versions prior to 2026.7, the REST API did not properly enforce team scopes, allowing users to submit invalid team configurations. By assigning projects to teams via unvalidated requests, users could grant access to unauthorized projects. This could expose private projects and allow operations outside intended permissions. Fixed in 2026.7.

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries admin page. An authenticated user with global settings:read permission can create a survey menu entry with attacker-controlled data. The value is stored and later inserted into a single-quoted HTML title attribute without proper encoding.

A vulnerability in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed TCP FIN packets without validating the sequence or acknowledgment numbers.

A vulnerability in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via the SPC Connect Pro software accepting replayed application-layer payloads injected into an active TCP session.

A vulnerability in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of service via spoofed SYN packets.

A vulnerability in openRISC OR1200 (commit 83ac6b) is due to an inaccurate update of program counter (PC) values when SPR changes, which can lead to a Denial of Service (DoS).

Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability. A low privileged attacker with remote access could potentially exploit this, leading to unauthorized access.

In the Dia diagram editor, there is a heap-based buffer overflow vulnerability in the WPG file format importer. The WPG import renderer allocates a fixed palette of 256 entries. When handling a WPG_COLORMAP record, the parser reads a start index and number of colors without validating bounds. A malicious WPG file can cause an out-of-bounds write, leading to a crash or potentially arbitrary code execution.