CVE Vulnerability Catalog

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials.

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform SSRF, making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error.

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity of the affected device. This vulnerability could be used in chain with CVE-2026-44104.

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the cleanup process.

An unauthenticated attacker can manipulate the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console. This allows controlling the domain of the generated password reset link, and when the victim clicks it, the reset code is sent to the attacker's host.

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser with JavaScript enabled. Untrusted or compromised Initializr endpoints can lead to arbitrary script execution when hovering a dependency checkbox.

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret as plain text in the launch configuration. The .launch file is saved as cleartext XML, potentially leaking the secret to the filesystem or version control.

An incomplete fix in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies. Affects versions 22.x, 24.x, and 26.x.

A flaw in Node.js HTTPS Agent connection reuse causes PFX object-array key collisions, allowing mTLS client identities to be reused across requests with different client certificates.

A flaw in Node.js Permission Model enforcement allows trace_events.createTracing().enable() to write trace logs outside the --allow-fs-write boundary.

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to denial of service.

A flaw in the PCP pmproxy service's pmLogLoadInDom() function allows a remote attacker to send a crafted request that bypasses a critical bounds check, causing a crash and potential memory information leak.

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 lacks capability and nonce checks when deleting custom icon font packs, allowing unauthenticated attackers to permanently delete all custom icons with a single request.

The RegistrationMagic WordPress plugin before 6.0.9.4 lacks authorization, ownership, and nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' submissions and profile fields of non-admin accounts.

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password cookie belongs to the requested identity, allowing unauthenticated attackers to read other users' form submissions, including personal information.

The Search Atlas SEO WordPress plugin before 2.6.12 lacks capability and nonce checks in an AJAX handler, allowing any authenticated user (e.g., Subscriber) to invoke the Google Indexing API, submit or remove site URLs from Google's index, and consume the indexing quota.