CVE Vulnerability Catalog

OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability allowing a low-privileged authenticated user to inject HTML/JavaScript payloads via Candidate, Company, Contact, Job Order, or List name/title fields. The value is stored unsanitized and later rendered unescaped in the 'Recent' (MRU) navigation panel shown on nearly every page via getFormatted() in lib/MRU.php. An attacker can execute arbitrary JavaScript in the session of any other user, including Site Administrators, enabling session/cookie theft and escalation to full administrative control.

Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results and data stored in Amazon S3 or other data sources were not accessible through this issue. AWS remediated the issue on October 7, 2026, and no customer action is required.

dnspython before 2.9.0 has a vulnerability where dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains without a hop limit. A malicious DNS wire-format message can force excessive pointer traversal during name decompression, causing high CPU use, application degradation, or denial of service in applications processing untrusted DNS messages. The issue is fixed in version 2.9.0.

The JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability allowing an authenticated WordPress administrator to write attacker-controlled file contents outside the intended restore destination during backup import and restore. An attacker can craft a backup archive containing a symbolic link that extraction follows without validating targets or enforcing destination containment, potentially leading to server-side code execution depending on the writable destination and server configuration.

Next.js from 13.0.0 until 15.5.28 and 16.4.1 has a vulnerability where crafted requests targeting App Router applications with at least one Server Action can cause excessive CPU consumption and block processing of further requests in the same process. Applications using the Pages Router and App Router applications without Server Actions are not affected. The issue is fixed in versions 15.5.28 and 16.4.1.

An issue in Webasyst Framework 4.0.3 and earlier allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL with an arbitrary redirect_uri.

In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not limited, as demonstrated by a QPACK amplification attack. This relates to header_out_dynamic_entry and es_max_header_list_size.

The cart and wishlist repositories of the MarcosCamara01 Ecommerce Template contain an authorization bypass through user-controlled key (CWE-639). cartRepository.delete(), cartRepository.updateQuantityInternal() and wishlistRepository.delete() match rows by primary key alone with no owner predicate, and per-user authorization relies on PostgreSQL row level security. Migrations enable RLS and create policies, but never FORCE ROW LEVEL SECURITY, and PostgreSQL does not apply policies to the table owner role; the application connects as the owner, so policies do not apply. Identifiers are sequential, so they can be enumerated, allowing any authenticated user to delete and modify other users' carts and wishlists.

The cart and checkout flow of the MarcosCamara01 Ecommerce Template contains external control of an assumed-immutable web parameter (CWE-472). POST /api/user/cart accepts variantId (what the order records) and stripeId (what Stripe charges) as independent fields with no check that stripeId belongs to variantId. POST /api/stripe/payment builds Stripe Checkout line items from the stored stripeId, while the checkout.session.completed webhook creates order products from the variantId, so the order records a product that was not paid for. All stripeIds are publicly readable, so no value must be guessed.

OCO-Server before 1.2.1 has a vulnerability where Html::commandButton() in lib/Html.class.php embeds an action URL containing a stored computer hostname into a JavaScript string in an inline onclick handler, using htmlspecialchars(ENT_QUOTES) only for HTML escaping. Browsers decode HTML entities before interpreting the handler as JavaScript, so a crafted hostname can escape the string and execute script in an administrator's authenticated session when an affected command button is activated. A remote attacker with the shared agent-registration-key can store an unchecked hostname via oco.agent.hello when agent self-registration is enabled (disabled by default). The issue is fixed in version 1.2.1.

CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot annotations). An attacker must craft a malicious .cleanshot file, deliver it to the target, and have the target open it; the payload then executes automatically during parsing, resulting in arbitrary code execution in the context of the current user. The vulnerability was fixed in versions 4.5.2, 4.6.3, 4.7.8 and 4.8.10.

Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications. From 0.6.0 until 0.8.2, the _escape() helper in falkordb_adapter.py escapes quotes before backslashes, allowing injected Cypher clauses to reach queries assembled by FalkorDBAdapter.add_graph_documents. When GRAPH_BACKEND=langchain and GRAPH_DB=falkordb are configured, attacker-influenced document content can cause malicious entity or relationship values to modify or delete graph data and disclose it. The issue is fixed in version 0.8.2.

multer is a Node.js middleware that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is configured with an asynchronous fileFilter, a single request can crash the Node.js process. If the request is aborted while a file's asynchronous fileFilter is still pending, the pending callback resumes a parsing stream that multer has already torn down, and the parser emits an error on a stream with no error listener, causing an unhandled error that exits the process. The issue is fixed in multer 2.5.0.

body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and from 2.0.0 before 2.4.0, a single request can crash any application using body-parser with default options. When a request carries a Content-Encoding such as gzip, body-parser pipes it into a decompression stream and, after reading the body, leaves that stream with no error listener; trailing bytes reach the already-finished decoder, which emits an error re-thrown as an uncaught exception that terminates the process. The issue is fixed in body-parser 2.4.0 and 1.20.9.

Rsyslog is a fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling, allowing the rendered path to escape the intended log directory. This is not limited to the RFC5424 HOSTNAME field. At time of publication, there are no publicly available patches.

In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that will never reach its end condition. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit condition (infinite loop). These messages must come from a device that has already joined the network. Only devices supporting manufacturer-specific clusters are impacted.

In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass authentication resulting in network disruption. This vulnerability does not allow an attacker to gain the Network Key or otherwise break confidentiality.

Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make server-side requests when an application parses attacker-controlled XML with Abdera. This issue affects all versions of Apache Abdera. Apache Abdera is retired and no longer supported, so no fix is planned.

Lotus through 0.10.2 contains an SQL injection vulnerability that allows authenticated organization users to inject SQL by registering crafted subscription_filter_keys that bypass keyword-only validation. Attackers can create subscriptions using the malicious key, which is rendered as an unquoted group-by identifier, to inject SQL into usage aggregation queries against the shared multi-tenant database.