CVE Vulnerability Catalog

Hirschmann HiLCOS products (OpenBAT, BAT450, WLC, BAT867) have a firewall filtering vulnerability that fails to correctly filter IPv4 multicast and broadcast traffic when management IP address filtering is disabled, allowing configured filter rules to be bypassed.

OpenPrinting CUPS up to version 2.4.16 has a heap-based buffer overflow in the CUPS scheduler when building filter option strings from job attributes. At the time of publication, no public patches are available.

In OpenPrinting CUPS versions 2.4.16 and prior, the RSS notifier allows path traversal in notify-recipient-uri, enabling a remote IPP client to write RSS XML bytes outside CacheDir/rss to any lp-writable location. By exploiting default group-writable permissions (root:lp, mode 0770), the notifier running as lp can overwrite root-managed state files, causing job cache parsing failures and loss of queued jobs after cupsd restart.

Discourse, an open-source discussion platform, has a vulnerability that exposes staged user custom fields and usernames on public invite pages without email verification. This affects versions from 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2026.3.0-latest to before 2026.3.0.

JupyterHub before version 5.4.4 has an open redirect vulnerability that allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site, bypassing JupyterHub's check to prevent this.

Discourse versions from 2026.1.0 to before 2026.1.3, 2026.2.0 to before 2026.2.2, and 2026.3.0 to before 2026.3.0 have an authorization bypass vulnerability. Unauthenticated or unauthorized users can view staff-only tags and associated data.

In util-linux prior to version 2.41.4, a TOCTOU vulnerability has been identified in the SUID binary /usr/bin/mount. When setting up loop devices, mount validates the source file path with user privileges but later re-canonicalizes and opens it with root privileges without verifying that the path has not been replaced. A local unprivileged user can replace the source file with a symlink pointing to any root-owned file or device.

OpenPrinting CUPS versions 2.4.16 and prior contain an authorization bypass vulnerability due to case-insensitive username comparison. This allows an unprivileged user to gain unauthorized access to restricted operations by using a username that differs only in case from an authorized user. No public patches are available at the time of publication.

The Amazon Athena ODBC driver before version 2.1.0.0 contains an out-of-bounds write vulnerability in query processing components. Specially crafted data can crash the driver during query operations.

OpenClaw before version 2026.4.2 reuses the PKCE verifier as the OAuth state parameter in the Gemini OAuth flow, exposing it in the redirect URL. Attackers who capture the redirect URL can obtain both the authorization code and PKCE verifier, defeating PKCE protection.

Development and test API endpoints that mirror production functionality are present in the application. This means they may be accessible in the production environment, posing a risk of unauthorized access.

A specific administrative endpoint 'notifications' is accessible without proper authentication.

Zulip before version 11.6 has a path traversal vulnerability in ./manage.py import that allows reading arbitrary files from the server filesystem. A crafted export tarball causes file copying to the uploads directory during import.

In Zulip before version 11.6, even after disabling spectator access, attachments from web-public streams remained anonymously accessible. Additionally, the /users/me/<stream_id>/topics endpoint remained reachable anonymously, allowing retrieval of topic history for those streams.

prompts.chat prior to commit 1464475 contains a blind SSRF vulnerability in the Wiro media generator. Authenticated users can send POST requests to /api/media-generate with a controlled inputImageUrl parameter, allowing them to probe internal networks, access internal services, and exfiltrate data through the Wiro service.

A weakness has been identified in BookStackApp BookStack up to version 26.03 in the chapterToMarkdown function of app/Exports/ExportFormatter.php (Chapter Export Handler). Manipulating the pages argument can lead to improper access controls. The attack can be launched remotely and the exploit is publicly available.

A flaw in rust-rpm-sequoia allows an attacker to provide a crafted RPM file that triggers an error in OpenPGP signature parsing, causing unconditional termination of the rpm process and denial of service.

In NASA cFS up to version 7.0.0 on 32-bit, an integer overflow vulnerability was identified in the CFE_TBL_ValidateCodecLoadSize function. The attack is difficult to execute but could lead to unexpected system behavior.

NASA cFS up to version 7.0.0 has a vulnerability in the function CFE_SB_TransmitMsg in file cfe_sb_priv.c of the CCSDS Header Size Handler component that can lead to memory corruption. The project was informed but has not responded.

In NASA cFS up to version 7.0.0, a heap-based buffer overflow exists in the function CFE_MSG_GetSize in file apps/to_lab/fsw/src/to_lab_passthru_encode.c. The attacker must have local network access. The project was informed but has not responded.