CVE Vulnerability Catalog

Squirro Cognitive Search before 3.14.2 has a Cross Site Scripting (XSS) vulnerability that allows a remote attacker to execute arbitrary code via the Email Notification, Create Evaluation Sets and HTML Editor functions.

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated `baseurl` parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints on the `RemoteFacilityUser*` viewsets; remediation review found two further reflection points on the same pattern. The GET endpoint was unauthenticated. Version 0.19.4 fixes the vulnerability.

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the cors_origins guard in glances/outputs/glances_restful_api.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain cors_credentials and expose authenticated REST API data to an untrusted website visited by a previously authenticated user. This issue is fixed in 4.5.6.

Zephyr's 6LoWPAN IPHC uncompression code contains an out-of-bounds read in get_ihpc_inlined_size() (subsys/net/ip/6lo.c). The destination inline size is looked up in da_inline_size_table (13 entries) using an index built from the M, DAC and DAM bits of the IPHC dispatch word; reserved combinations 13, 14 and 15 are not bounds-checked and read past the end of the table.

The ARM PL011 UART driver (drivers/serial/uart_pl011.c) fails to acknowledge receive error interrupts. Framing, parity, break, and overrun errors are cleared only by writing the UARTICR register, but the interrupt service routine pl011_isr() does not do this, leaving the interrupt pending. An attacker controlling the serial peer can trigger these errors, causing an interrupt storm and permanent system hang.

The WNC-M14A2A LTE-M modem driver mishandles unsolicited %NOTIFYEV events, leading to out-of-bounds stack read and a single out-of-bounds stack write. The vulnerability can be triggered by a rogue base station or compromised modem without application interaction.

In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible.

In JetBrains IntelliJ IDEA before 2026.2.1 XXE was possible in the Eclipse settings importers.

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log.

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE.

In JetBrains IntelliJ IDEA before 2026.2.1 SSRF was possible via the OpenAPI preview proxy in untrusted projects.

In JetBrains IntelliJ IDEA before 2026.2.1, a Server-Side Request Forgery (SSRF) was possible via the DevKit debug listener endpoint.

In JetBrains YouTrack before 2026.1.13903 and 2026.2.17950, an authenticated user could read restricted articles from other projects via the draft creation endpoint.

In JetBrains YouTrack before 2026.2.18177, a Denial of Service (DoS) attack was possible via a decompression bomb in the import endpoint.

In JetBrains YouTrack before 2026.2.18112, an authenticated user could enumerate accounts via the users search endpoint.

A vulnerability in jae-jae fetcher-mcp up to 0.3.9 affects the fetch_url/fetch_urls function in the URL Validation component, allowing a Server-Side Request Forgery (SSRF) attack. The attack can be launched remotely.

In JetBrains Ktor before 3.4.1, a potential Denial of Service (DoS) attack via WebSocket decompression was possible.

In New API (LLM gateway and AI asset management system) from 0.9.1.3 to 1.0.0-rc.7, the AdminResetPasskey function in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset_passkey, allowing a lower-privileged administrator to remove a passkey from a same-level or higher-privileged account, including a root account.

In New API prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high.

In Discourse prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt (and permalink) of the private message attached to a flag, even when the reviewing category moderator was not a participant in that message. These notify_moderators flag messages are addressed only to moderators and, for core flags, to a category's moderation groups as they existed when the flag was raised, so a category group moderator could read flag-discussion content they were not authorized to see. This affects official plugins that create such messages and core flags raised before a moderator's group was granted moderation of the category. Only the confidentiality of a limited excerpt of these flag-related private messages is affected; no content can be modified or deleted.