CVE Vulnerability Catalog

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php. An attacker can inject a malicious script that executes in the admin panel context.

The re2 library for Node.js prior to version 1.25.2 validates lastIndex against the UTF-8 byte length of a subject but uses it as a UTF-16 code-unit offset in exec, test, match, replace, and split. This allows an out-of-bounds heap read and an uncatchable process crash, with limited heap information disclosure in some cases.

WACRM 0.7.0 and earlier allows an authenticated user with automation privileges to submit an arbitrary webhook URL that the server fetches without SSRF protection, enabling requests to private, loopback, link-local, or cloud metadata addresses.

OpenProject before 17.6.0 in GET /api/v3/time_entries and GET /api/v3/cost_entries exposed private work package titles and IDs without visibility checks. Users with view_time_entries or view_cost_entries could read this data.

OpenProject before 17.6.0 in GET /api/v3/custom_options/:id resolved custom options by global numeric ID without visibility checks. Authenticated non-admin users could enumerate IDs and read labels of admin-only options.

Capsule from 0.13.0 to 0.13.8 (after incomplete CVE-2026-22872 fix) did not apply cluster-scoped resource rejection guards, allowing a Tenant Owner to create cluster-scoped resources like ClusterRole or ValidatingWebhookConfiguration via the cluster-admin controller client.

Capsule before 0.13.8 did not validate regular expressions in CapsuleConfiguration for ForbiddenLabels and ForbiddenAnnotations. A Cluster Admin could store malformed regex that crashed the node admission webhook on node create, update, or patch requests.

IBM UrbanCode Deploy 7.2-7.2.3.23, 7.3-7.3.2.18 and IBM DevOps Deploy 8.0-8.0.1.13, 8.1-8.1.2.6, 8.2-8.2.1.0 are vulnerable to exposure of sensitive information in plugin output logs. An attacker with log access can obtain sensitive values related to that step.

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of arbitrary JavaScript in the context of the hosting site.

MaxKB from version 2.0.0 to 2.10.4-lts in UpdateStoreTool.update_tool passes caller-supplied download_url and download_callback_url to requests.get without trusted-host and redirect validation. An authenticated workspace user can make the server request internal, loopback, link-local, or cloud metadata URLs.

AIOHTTP before 3.14.2 in the WebSocket client accepts and decompresses frames with the RSV1 bit set even without negotiating the permessage-deflate extension. A malicious server can cause unexpected CPU and memory consumption.

SGLang contains an SSRF and local file read vulnerability in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata, secrets, and services.

A product with the MikroTik RouterOS API enabled is vulnerable to insufficient session expiration. Active sessions may retain their previous permission set after inactivity timeouts or user-group changes.

IBM Verify Identity Access and Security Verify Access products may return detailed technical error messages in the browser, allowing a remote attacker to obtain sensitive information.

IBM Langflow OSS has multiple broken access control vulnerabilities in its file handling API. Unauthenticated attackers can retrieve image files, and authenticated users can access files belonging to other users.

IBM Db2 federated server is vulnerable to a denial of service when running non-fenced federated queries.

IBM DataPower Gateway is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A privileged user could expose sensitive information or consume memory resources.

IBM Engineering Requirements Management DOORS and DOORS Web Access are vulnerable to cross-site scripting (XSS). An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI.

IBM Operations Analytics - Log Analysis does not invalidate session after a password change, which could allow an authenticated user to impersonate another user.

Leantime 3.6.2 contains an open redirect vulnerability in the Login controller, allowing unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter, bypassing FILTER_SANITIZE_URL validation.