CVE Vulnerability Catalog

Russh library before version 0.62.5 dispatches channel-scoped Handler callbacks for recipient channel IDs that were never opened or confirmed. The issue is fixed in version 0.62.5.

OpenEMR through 8.2.0 contains a stored XSS vulnerability in the patient portal template system. Authenticated administrators can inject arbitrary HTML and JavaScript by storing malicious payloads through the template save mode, which only filters literal PHP open tags. Lack of output encoding at the template retrieval endpoint and missing HttpOnly cookie attributes allow session token exfiltration via document.cookie.

NewType WebEIP up to version 3.0 has a vulnerability in the file /EIP_Com_FileList.aspx that leads to improper authentication. The attack can be performed remotely, and the exploit is publicly available.

The textPlus Text Message and Call App on Android up to version 8.3.5 has a vulnerability in the DialerActivity function of the com.gogii.textplus component, leading to improper export of Android application components. The attack requires local access, and the exploit is publicly available.

GNU tar has a TOCTOU vulnerability in incremental dumpdir 'X' rename handling. A local attacker with write access to a directory being backed up can influence the restore process if they have access to the system where the restore is performed. During restoration, files or directories may be created, renamed, or overwritten outside the intended extraction directory, potentially leading to unauthorized file modification or privilege escalation.

Certain HP DesignJet products may be vulnerable to XSS, allowing unauthenticated HTTP requests to view print job previews.

389 Directory Server has a vulnerability in SASL PLAIN authentication. The server installs connection-level bind credentials before performing the account-lock check. If the account is locked, the bind is reported as failed, but the authenticated state on the connection is not reverted. A client with valid credentials for a locked account can continue to use the connection with that account's privileges.

GNU tar has a vulnerability when extracting an archive with the --one-top-level option. Hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction.

A vulnerability in the xhunter2.sys driver of Wellbia XIGNCODE3 (version 2026.6.1.192) allows a local, unprivileged attacker to escalate privileges to SYSTEM level. The attacker can also extract credentials from PPL-protected lsass.exe and terminate PPL-protected security processes.

Admidio before version 5.0.11 contains an IDOR vulnerability in the save_temporary mode of mylist_function.php that allows authenticated users to hijack list configurations. Attackers can enumerate global list UUIDs and overwrite admin-curated global lists or other users' private lists by supplying a list_uuid parameter, transferring ownership and demoting global lists to personal configurations.

Admidio before version 5.0.11 does not validate the adm_csrf_token in modules/category-report/preferences.php, which performs persistent Category Report configuration changes based on GET parameters (delete and copy). An attacker can trick an authenticated administrator into visiting a crafted URL to delete or duplicate Category Report configurations, affecting the integrity and availability of that module's configuration.

Admidio before version 5.0.11 contains a reflected cross-site scripting vulnerability in the SSO/SAML endpoint. Unauthenticated attackers can inject arbitrary JavaScript via SAML Issuer elements or LightSaml library parameters, enabling session hijacking.

Admidio before 5.0.11 fails to validate target organization membership in role handlers. Authenticated role administrators can delete, activate, deactivate, or edit roles belonging to other organizations by supplying a role UUID from another organization.

The Grav form plugin (getgrav/grav-plugin-form) before version 9.1.13 contains an open redirect vulnerability. Since v9.1.11, the redirect process action evaluates user-supplied form data inside Twig expressions, and Grav::redirect() accepts external URLs without origin validation. An unauthenticated user can supply a malicious URL, causing a 302 redirect to an arbitrary external site.

SiYuan before version v3.7.3 contains a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint. Anonymous readers or RoleReader tokens can retrieve the title, notebook, path, root ID, and icon of documents marked as excluded from publishing.

HCL iControl is affected by weak SSL/TLS version support. The application used outdated protocols TLS 1.0 and 1.1, which lack modern security features and are vulnerable to known attacks, exposing sensitive data during transmission.

In SSSD, the sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the packet size. A local attacker can send a crafted GETHOSTBYADDR request, causing an out-of-bounds read and process crash (DoS).

FlowIntel is vulnerable to stored XSS via multiple user-controlled or administrator-controlled fields. Injected Vue expressions are processed by the framework, allowing arbitrary JavaScript execution in the victim's browser.

Sharp and Toshiba Tec MFPs for a specific market are shipped with user authentication disabled in the initial configuration. This allows editing the address book and document filing features without authentication.

Network Scanner Tool and Network Scanner Tool Lite by Sharp, in default configuration, require no authentication and accept files without limits. Anyone can upload files, leading to DoS on the PC and potential execution of malicious files.