CVE Vulnerability Catalog

A security issue exists within OTTO® Fleet Manager. The vulnerability stems from the use of an insufficient work factor in the bcrypt password hashing implementation, which could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes. If an attacker gains access to an unencrypted system backup, the weakly hashed credentials could be more easily compromised.

Wekan prior to 10.38 contains a vulnerability in several export endpoints where the authToken query parameter is used without checking if the user exists. A request for a private board with an unknown token throws a TypeError, producing an unhandled rejection that could terminate the Wekan process and deny service to all users. Version 10.38 adds a 401 guard and wraps export handlers with safeRoute().

Wekan from 9.57 until 9.74 contains a vulnerability in the /api/boards/:boardId/exportExcel route where the authorization guard exporterExcel.canExport(user) is not awaited. The returned Promise is always truthy, so exporterExcel.build(res) runs even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board data. Fixed in version 9.74.

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records are incorporated without sanitization into AJAX responses and rendered as HTML. An attacker who controls a PTR record and generates sufficient traffic can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session and enabling account creation and arbitrary OS command execution.

Logto, the modern open-source auth infrastructure, versions 1.40.1 to 1.41.0, has a vulnerability in GitHub Actions workflow where the pull request title is directly interpolated into an echo command in the commitlint step. A title containing a single quote can terminate the echo string and append arbitrary shell commands on the runner. An attacker can disrupt the ephemeral workflow execution, but repository secrets are not exposed.

BuildKit, a toolkit for building artifacts, prior to version 0.31.1 has a vulnerability where a custom frontend can place an invalid SecurityMode value in a crafted build request. The executor treats this value as a non-sandbox mode without requiring the security.insecure entitlement, disabling Seccomp and AppArmor protections for the build container while Linux capabilities remain restricted.

Etherpad, a real-time collaborative editor, prior to version 3.3.0 has a stored XSS vulnerability in getHTMLFromAtext where values from the exportHtmlAdditionalTagsWithData plugin hook are interpolated into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool, and opening the HTML export executes the script in the Etherpad origin.

Etherpad versions 2.6.0 to 3.1.0 have a vulnerability in the token transfer mechanism where an author token is stored and exposed via GET /tokenTransfer/{uuid} without expiration or removal after redemption. An unauthenticated attacker who obtains the UUID can repeatedly redeem it, receive fresh author cookies, and impersonate the author.

Etherpad versions 2.1.0 to 3.1.0 use the attacker-controlled x-proxy-path header when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary, or Cache-Control. A shared proxy or CDN can cache the response and serve attacker-injected script to an administrator. Version 3.0.0 also accepts a protocol-relative x-proxy-path value, allowing redirection to an attacker-controlled host.

Etherpad prior to version 3.1.0 generates temporary filenames using Math.random() and places them in the system temp directory. A local attacker who predicts the filename can create a symbolic link to a file writable by the Etherpad process, allowing overwrite with partially attacker-controlled content during import or export.

Lemmy, a link aggregator and forum for the fediverse, versions 0.19.18 to 0.19.19 and 1.0.0-alpha.20, allows a community moderator to feature or unfeature posts in other communities via federated CollectionAdd and CollectionRemove activities. Lack of verification that the post belongs to the community enables manipulation of other communities' content.

Improper input validation in `ajaxSet_wireless_network_configuration.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows an authenticated attacker to cause denial of service via a crafted `ssid_number` parameter.

IBM PowerVM Hypervisor in specific versions has a vulnerability in partition firmware during network boot. An unauthenticated attacker with network access can prevent a partition undergoing iSCSI SAN network boot from completing its boot sequence, causing availability impact only to that partition.

IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 have a vulnerability that could allow a local attacker to execute arbitrary code due to an out-of-bounds write.

IBM AIX 7.2 and 7.3 and IBM PowerVM VIOS 4.1 have a vulnerability that could allow a local attacker to cause a denial of service due to an out-of-bounds write.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds write.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to obtain sensitive information due to an out-of-bounds read.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an out-of-bounds read.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to a heap buffer overflow.

IBM AIX 7.2, 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper check for an array index boundary.