CVE Vulnerability Catalog

XWiki Platform WebJars API, a package for XWiki, versions from 9.6-rc-1 to 16.10.17, 17.4.9, and 17.10.3 have a path traversal vulnerability that allows an attacker with a malicious WebJar extension installed to write arbitrary files. This requires admin access to a subwiki. Fixed in versions 16.10.17, 17.4.9, 17.10.3, and 18.0.0RC1.

Ghostfolio, an open source wealth management software, prior to version 3.4.0 has a vulnerability in the Stripe checkout success-URL handler that grants a Premium subscription without checking payment status. Any authenticated user can self-grant a 1-year Premium subscription without paying. Fixed in version 3.4.0.

Kata Containers before version 4.0.0 has an authorization bypass vulnerability in confidential-guest memory management. Two ttRPC methods introduced with the mem-agent feature lack the AgentPolicy authorization check, allowing an untrusted host to manipulate guest memory when mem-agent is enabled (off by default). The impact is limited to availability and performance degradation, not memory disclosure or code execution.

OpenBao before version 2.5.4 has a vulnerability in the Kerberos auth method where the response to a GET request or with an Authorization: Negotiate header includes a logical.Auth object in addition to an error message. This results in tokens being created with default policy, default TTL, and no entity information, hidden by the error message. These tokens are not accessible to the caller or outside sys/raw.

The SF32LB MPI QSPI NOR flash driver has a vulnerability in offset and length validation for read and write operations. Due to signed offset and unsigned size, a negative offset is converted to a large unsigned value and the addition can wrap to a small result that passes the check, allowing access outside the mapped flash window.

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before processing by internal flash-write logic. Successful exploitation may cause the httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition.

A denial-of-service vulnerability exists in the httpd service on Archer A6 v4 where the asynchronous systool instruction handling path does not properly synchronize or safely manage concurrent systool operations. Sending crafted systool instructions through the asynchronous request path may cause the httpd process or device management service to crash, resulting in temporary loss of access to the web management interface or device reboot.

Adobe Genuine Software Integrity Service on Windows is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation does not require user interaction, but requires local or remote access to the target desktop system.

Hono before version 4.12.34 has a ReDoS vulnerability in the built-in CORS middleware (hono/cors). During a preflight OPTIONS request, the middleware parses the Access-Control-Request-Headers header using a regular expression with quadratic complexity, which can cause long CPU consumption and block request processing. This affects the default configuration when allowHeaders is unset or empty.

Home Assistant before version 2026.6.1 has an open redirect vulnerability in the Android Companion app. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without displaying the destination hostname, allowing an attacker to craft an invite that leads to a look-alike login page capturing credentials.

JupyterHub before version 5.5.0 has a vulnerability where invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources.

OpenBao before version 2.5.4 has a vulnerability in the inline auth functionality that incorrectly redacts audit log entries, removing non-auth headers and retaining auth-related headers in cleartext. This requires an attacker to compromise access to the audit device.

A vulnerability was found in HKUDS nanobot up to 0.2.1 in the _download_image_data_url function of nanobot/providers/image_generation.py, leading to server-side request forgery (SSRF). The attack can be initiated remotely and the exploit is public. Applying a patch is recommended.

A vulnerability was detected in HKUDS nanobot up to 0.2.1 in the connect_mcp_servers function of nanobot/agent/tools/mcp.py, leading to improper access controls. The attack can be performed remotely and the exploit is public. Upgrading to version 0.3.0 fixes the issue.

Domoticz versions prior to 2026.3 contain a stored cross-site scripting vulnerability in the mobile dashboard, allowing authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders data via ng-bind-html without proper escaping, enabling malicious payloads to execute in an administrator's browser.

SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash.

HAPI FHIR prior to 6.9.11 contains a stored cross-site scripting vulnerability in the hidden scan command, which concatenates attacker-controlled titles and source references without escaping in Scanner.java. A user scanning a malicious IG/profile and opening the generated HTML report can trigger stored XSS, executing attacker-controlled JavaScript in the report's browser context.

A vulnerability was detected in HKUDS nanobot up to 0.2.1 in the ExecTool._guard_command/ExecTool._spawn functions of nanobot/agent/tools/shell.py, leading to OS command injection. The attack can be executed remotely and the exploit is public. Upgrading to version 0.3.0 is recommended.

Consul Community Edition and Consul Enterprise versions 1.3.0 through 2.0.2 are vulnerable to an unauthenticated denial of service in several agent HTTP API endpoints. A remote caller could cause the agent to consume substantial memory before the request was rejected. This is fixed in Consul 2.0.3 and corresponding Enterprise versions.

Consul Community Edition and Consul Enterprise versions 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `operator:write` permission may direct Consul to read and forward credential files outside the intended scope, potentially leading to exfiltration of sensitive secrets from the Consul server host.