CVE Vulnerability Catalog

A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v1/plamange/plansImmediate. Manipulation of the order/sort arguments leads to SQL injection. Remote exploitation is possible, and the exploit is public.

A vulnerability was identified in ractivejs up to 1.4.4 in the Ractive#set function of the Keypath Handler component. Manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely and the exploit has been made public.

A security flaw was discovered in alibaba-fusion next up to 1.27.34 in the ConfigProvider.getContextProps function of the deepMerge component. Manipulating the locale argument results in improperly controlled modification of object prototype attributes. The attack can be initiated remotely.

The Velociraptor verify() VQL function allows a user to verify an artifact for syntactic and other issues. Due to an implementation fault, the global artifact repository is used, allowing callers to overwrite existing artifacts without the required permissions. The attacker only needs NOTEBOOK_EDIT permission (e.g., an analyst role) to call this function.

A vulnerability was determined in jQWidgets up to 24.0.1 in the JQXLite.extend and jqxBaseFramework.extend functions of the file jqwidgets/jqx-all.js. This manipulation causes improperly controlled modification of object prototype attributes. The attack can be initiated remotely.

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0 in an unknown functionality of the file /pages/processlogin.php. Manipulation of the User argument leads to SQL injection. The attack can be initiated remotely and the exploit has been disclosed publicly.

A flaw has been found in UTT HiPER 1200GW up to 2.5.3-170306 in the strcpy function of the file /goform/formConfigFastDirectionW. Manipulating the ssid argument can lead to buffer overflow. The attack may be performed remotely and the exploit has been published.

The exceljs library through version 4.4.0 fails to neutralize leading equals, plus, minus, or at signs in cell values written to CSV output. Attackers who can influence exported cell values can inject formulas that execute when the CSV file is opened in a spreadsheet application, potentially exfiltrating data or performing other malicious actions.

The exceljs library through version 4.4.0 contains a path traversal vulnerability in the Workbook.addImage() function that fails to validate file paths. Attackers can supply arbitrary file paths to read any file accessible to the Node.js process and embed it in the generated workbook.

The exceljs library through version 4.4.0 decompresses all entries from supplied xlsx archives into memory without limits on entry size, total size, or compression ratio. Attackers can upload highly compressed workbooks that expand to gigabytes in memory, exhausting available resources and causing denial of service.

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.

A vulnerability was found in libwebsockets 4.5.0 in the report_raw_cbor function of lib/misc/lecp.c in the LECP CBOR Recording component. Manipulation leads to an out-of-bounds write. The attack can be launched remotely, and the exploit is public.

A vulnerability was detected in Open5GS 2.8.0 in the pcrf_rx_aar_cb function of src/pcrf/pcrf-rx-path.c in the Rx AA-Request Handler component. Manipulation leads to an out-of-bounds read. The attack can be initiated remotely.

A security vulnerability was detected in Open5GS 2.8.0 in the hss_ogs_diam_s6a_air_cb function of src/hss/hss-s6a-path.c in the S6a Authentication-Information-Request Handler component. Manipulation of the Visited-PLMN-Id argument leads to a heap-based buffer overflow. The attack may be performed remotely.

A vulnerability in llama.cpp in the deserialize_tensor function of ggml/src/ggml-rpc/ggml-rpc.cpp of the ggml-RPC Server component. Manipulation of the op/op_params arguments leads to deserialization. The attack can be initiated remotely. This vulnerability is distinct from CVE-2026-34159, which only added a buffer==nullptr rejection in create_node() and does not validate op or op_params. The reported GitHub issue was closed automatically due to inactivity.

A vulnerability in code-projects Barangay Resident Profiling Management System 1.0 in an unknown function of the residents.php file of the Resident Search Functionality component. Manipulation of the Search argument causes SQL injection. Remote exploitation is possible. The exploit has been publicly disclosed and may be utilized.

A vulnerability in Tenda CH22 1.0.0.1 in the formexeCommand function of the /goform/exeCommand file. Manipulation of the cmdinput argument leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

justhtml through 1.9.1 (fixed in 1.10.0) is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML() construction, TreeBuilder.finish() calls _populate_selectedcontent(), which recursively traverses the DOM tree without a depth bound. An attacker can supply deeply nested elements (e.g., ~1000 nested <div> tags) to exceed CPython's recursion limit and trigger an unhandled RecursionError.

justhtml before 1.18.0 contains multiple low-severity denial-of-service issues in CSS selector handling and linkification. Applications that evaluate attacker-controlled selector strings, run selector matching over very large untrusted documents, construct DOM trees from untrusted structure, or enable linkification over attacker-controlled text may consume disproportionate CPU or memory. These are availability-only concerns and do not allow script execution, data disclosure, or sanitizer bypass.

GitLab CE/EE versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a path traversal vulnerability in the package registry that under certain conditions could allow an authenticated user to achieve remote code execution.