CVE Vulnerability Catalog

Airbyte OneDrive Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources.

Airbyte SharePoint Connector _get_shared_drive_object Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the _get_shared_drive_object method. The issue results from the lack of proper validation of a URI prior to accessing resources.

A vulnerability in Luxion KeyShot during BIP file parsing allows remote code execution in the context of the current process. The flaw results from loading a library from an unsecured location (uncontrolled search path element). User interaction is required: the target must visit a malicious page or open a malicious file.

GIMP contains a stack-based buffer overflow in APNG file parsing due to lack of proper validation of user-supplied data length before copying it to a stack buffer. A remote attacker can achieve arbitrary code execution in the context of the current process if the target opens a malicious file or visits a malicious page.

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts without channel- or session-specific input, and the user service validates tokens without verifying channel context, enabling stolen tokens to grant persistent administrative access until the token store is explicitly cleared.

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those internal responses as gallery content.

A vulnerability was identified in ProjectWorlds Advanced Library Management System 1.0. The mysqli_query function in individual_report_search.php is affected by manipulation of the roll_number argument leading to SQL injection; the attack may be launched remotely and the exploit is publicly available.

In file-management-system (commit dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df), the store function in app/Http/Controllers/FileController.php allows unrestricted file upload via manipulation of the File argument. The exploit has been publicly disclosed and can be launched remotely.

Storybook from 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6 allows the development server to expose its WebSocket authentication token to clients able to load its HTML pages over a local network. A LAN attacker can obtain the token and invoke WebSocket-backed file-writing or testing functionality. Weak story-write validation can allow code to be placed in story files, and with the Vitest addon, the payload can use a Vitest API to write files or execute commands, leading to code execution with developer privileges.

Storybook is a frontend workshop for building UI components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook development server due to insufficient iframe embedding and message-origin restrictions. A developer must visit the malicious website and interact with the injected interface.

The vulnerability in NoMachine Device Service stems from incorrect permissions on a named pipe. A local attacker able to execute low-privileged code can exploit this flaw to escalate privileges and execute arbitrary code in the context of SYSTEM.

The multicluster-global-hub-operator-bundle operator is configured with overly broad RBAC permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts without restriction. An attacker who compromises the operator or obtains its service account credentials can exploit this flaw to escalate privileges and gain full administrative control over the cluster.

The Snort 3 control channel socket implementation lacks authentication when a local user connects to the socket. An authenticated local attacker with low privileges can execute arbitrary commands as the Snort 3 process user and read or write the process memory.

A vulnerability in IPv4 packet processing in Cisco IOS XR Software affects ASR 9000 and 9900 Series routers and ASR 9902/9903 Compact routers. Incorrect handling of crafted IPv4 packets processed as for-us traffic can cause network processor errors, line card reset or shutdown, and denial of service.

Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76496 relate to improper link resolution (CWE-59).

Cisco conducted an internal security review of Cisco Expressway Series software, resulting in hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76495 relate to incorrect permission assignments (CWE-732).

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76494 are related to code injection issues grouped under CWE-94.

Cisco Expressway Series contains vulnerabilities related to uncaught exceptions (CWE-248), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains vulnerabilities related to null pointer dereferences (CWE-476), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.

Cisco Expressway Series contains vulnerabilities related to reachable assertions (CWE-617), discovered during an internal security review. Hardening releases address multiple internally discovered vulnerabilities.