CVE Vulnerability Catalog

The ip-address library in JavaScript versions 10.1.1 through 10.2.0 is vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses. These addresses are incorrectly classified as Global unicast, bypassing isLoopback, isUnspecified, isMulticast, isLinkLocal, and isULA checks. For IPv4-mapped addresses, this is reachable on any dual-stack host; for NAT64, it requires a NAT64/DNS64 gateway.

In Papra prior to version 26.5.0, an authenticated user who is a member of any organization can delete or rename tags belonging to a different organization, given the target tag's ID. The access control checks organization membership at the URL level, but the database query filters only by tag ID, bypassing the organization scope.

In Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and version 2026.1.23.0 and earlier, improper access control in the PAM password history endpoints allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.

An improper access control vulnerability in the NetBox synchronizer in Devolutions Server. An authenticated user with view-only permission can obtain a stored API token.

A vulnerability in Apache Wicket due to use of insufficiently random values and protection mechanism failure. Affects versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0. Upgrade to version 10.10.0 is recommended.

A Cross-Site Scripting (XSS) vulnerability in Apache Wicket due to improper input neutralization during web page generation. Affects versions 9.0.0 through 9.23.0 and 10.0.0 through 10.9.0. Upgrade to version 10.10.0 is recommended.

In unitedbyai droidclaw up to version 0.5.3, an authorization bypass vulnerability exists in the file server/src/routes/goals.ts in the Unsigned Scheduled Callback component. The attack is remote, high complexity, and exploit is publicly available.

In phpMyFAQ before version 4.1.6, a privilege escalation vulnerability exists in GroupController::updateMembers(). Administrators with group-management permissions can join privileged groups without verification.

A Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. The zip:unzip/1,2 and zip:extract/1,2 functions improperly validate paths, allowing bypass of protections.

HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.

A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file with an oversized chunk size field via h5repack may cause the application to abort due to a double free.

Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 allows attackers to cause a denial of service (crash) via a crafted HDF5 file with a shared-message list index declaring a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes.

A security flaw in AstrBotDevs AstrBot up to 4.25.5 involves incorrect authorization in the function _build_handoff_toolset of the Subagent component. The attack can be launched remotely. Exploit is publicly available.

A vulnerability in AstrBotDevs AstrBot up to 4.25.5 involves incorrect authorization in an unknown function of astrbot/core/astr_main_agent.py via manipulation of the req.func_tool argument. The attack can be launched remotely. Exploit is publicly available.

Unauthenticated Broken Access Control in Gillion versions up to 4.13.

Administrator Arbitrary File Deletion in Easy Digital Downloads versions up to 3.6.9.

Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager versions up to 3.0.5.

Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script versions up to 1.1.8.

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks versions up to 1.3.3.

The Open User Map plugin up to version 1.4.46 contains a Cross Site Scripting (XSS) vulnerability exploitable by a contributor. This allows injection of malicious scripts into the page.