CVE Vulnerability Catalog

In JetBrains IntelliJ IDEA before 2026.2.1, command execution via crafted Markdown preview content was possible in trusted projects.

Dell ObjectScale versions prior to 4.3.0.1 contain a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.

Dell iDRAC9 versions prior to 7.20.30.50 and Dell iDRAC10 versions prior to 1.20.60.50 contain a Remanent Data Readable after Memory Erase vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative, producing predictable values. Fixed by removing the import in 1.4.0.

In openssl_encrypt versions before 1.4.0, a logging bug in restore_hidden_modules() logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation, which in multi-threaded environments could allow another thread to re-import blocked modules.

In openssl_encrypt (pip) versions <= 1.4.7, an information exposure vulnerability exists where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr (crypt_cli.py, handle_hsm_command). The printed value can persist in terminal scrollback, session recordings, or CI logs. Impact is limited because the pepper is derived from a random per-invocation test salt and is salt-bound, so the leaked value cannot be used to decrypt real files. Fixed in 1.4.8 (and 1.5.0) by removing the hex dumps and routing plugin debug output through the redaction layer.

Use-after-free vulnerability in the time and time zone module. Successful exploitation may affect availability.

Cross-site scripting vulnerability in Webkul Bagisto up to 2.4.4, in the file /customer/account/rma/send-message of the RMA Message Handler component. Manipulation of the Message argument allows remote script execution in the browser. The exploit has been publicly disclosed.

Vulnerability in DualSafe Password Manager & Digital Vault extension up to 1.4.35 on Chrome, affecting an unknown function of the postMessage-based Bridge component. Manipulation leads to information disclosure. The attack can be launched remotely but is difficult to exploit. The exploit has been published.

A weakness has been identified in Azuriom CMS up to version 1.2.12. This affects the function transferMoney of the file app/Http/Controllers/ProfileController.php of the Money Transfer Handler component. The manipulation causes a time-of-check time-of-use issue. The attack can be initiated remotely but requires high complexity.

A vulnerability was determined in automad up to version 2.0.0-beta.32. This affects the function requestPasswordResetToken of the file automad/src/server/Controllers/API/UserController.php of the Password Reset Endpoint component. Manipulation of the argument name-or-email causes an observable response discrepancy. The attack can be initiated remotely but is difficult.

A vulnerability was detected in TrailDB 0.6. It affects the tdb_open function in /src/tdb.c of the TOC Validation component. The manipulation results in an out-of-bounds read. The attack can be launched remotely and the exploit is public.

OpenTofu versions before 1.11.4 contain a denial of service vulnerability in the tofu init command when processing maliciously-crafted .zip archives for provider or module packages. Attackers can cause excessive CPU usage by controlling .zip archive content served during dependency installation, degrading system performance and preventing timely completion of the init process.

A security flaw was discovered in code-projects Online Shopping System 1.0 in the file /checkout.php. Manipulating the amount_1 argument results in cross site scripting. The attack can be initiated remotely, and the exploit is public.

A vulnerability was detected in the Online Food Order System 1.0 by code-projects. It affects an unknown function in the file edit_food_items.php. Manipulation of the argument dname leads to cross-site scripting. The attack can be performed remotely, and the exploit is publicly available.

A weakness was identified in pkp-lib versions 3.3.0, 3.4.0, and 3.5.0. It affects the setData function in the file classes/user/form/APIProfileForm.php, related to API Key Generation. Manipulation of the apiKey argument leads to insufficient entropy. The attack can be performed remotely but has high complexity and is difficult to exploit. A patch is available with ID 529b5df878e571ccc727647f7748eafc1466b041.

A vulnerability was found in SourceCodester Online Book Store System 1.0. It affects unknown code in the file /admin/index.php?page=site_settings of the System Settings Module. The manipulation leads to cross-site scripting. The attack can be executed remotely, and the exploit is publicly available.

In VictoriaMetrics up to version 1.146.0, a vulnerability was found in the VMAuth Authentication Endpoint component, in the requestHandler function of app/vmauth/main.go. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. Upgrading to version 1.147.0 is recommended.

In the dtale tool (mangroup) up to version 3.22.0, a vulnerability was found in the Login function in dtale/auth.py. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but has high complexity. The exploit has been published, and the project has not responded.

In the dtale tool (mangroup) up to version 3.22.0, a vulnerability was found in the build_secret_key function in dtale/app.py, related to Flask session cookies. The issue is insufficiently random values, which may allow an attacker to predict the session key. The attack is remote but requires high complexity. The exploit has been published, and a pull request with a fix awaits acceptance.