CVE Vulnerability Catalog

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.

Progress MOVEit Transfer suffers from insufficient session expiration. An attacker can exploit an unexpired session to gain unauthorized access.

Progress MOVEit Transfer has a permissive cross-domain security policy, allowing communication with untrusted domains. This can lead to cross-domain attacks.

Progress MOVEit Transfer contains an improper authentication vulnerability. An attacker can bypass authentication mechanisms and gain unauthorized access.

An out-of-bounds write vulnerability in the vf_swaprect video filter in FFmpeg versions 3.0 through 8.1.2. An attacker can supply a crafted NV12 frame with odd width, causing heap corruption and potential code execution.

A vulnerability in the vf_floodfill video filter in FFmpeg versions 3.4 through 8.1.2 causes an out-of-bounds write on the heap. When config_input() allocates a stack based on initial frame dimensions and a larger frame is processed, filter_frame() pushes neighbors beyond the original allocation, leading to heap corruption and potential code execution.

A vulnerability in FFmpeg through version 8.1.2 allows heap corruption via a crafted ffconcat file processed with the -safe 0 flag. The TY demuxer's demux_audio() function decrements packet size without bounds checking, resulting in a negative size that, when converted to size_t in shorten_decode_frame(), causes reads beyond the source and writes beyond the Shorten decoder's bitstream buffer.

FFmpeg versions 2.7 through 8.1.2 contain an out-of-bounds write vulnerability in the TDSC video decoder that allows remote attackers to cause heap corruption by supplying a crafted AVI file.

gpsd up to release-3.27.5 contains a code injection vulnerability in gpsprof, where an attacker controlling GPS input can inject arbitrary OS commands via the SKY.satellites[].used field, which is unsanitized in a gnuplot heredoc.

In nebula-mesh before version 0.3.2, in internal/configgen/generator.go, the ListenHost and TunDevice fields are interpolated without validation into a text/template, potentially leading to code injection. internal/web/advanced.go accepts these fields with only whitespace trimming, no character or shape validation.

In the Quinn library (a Rust implementation of the QUIC protocol), a vulnerability exists in the Assembler component that reassembles unordered stream fragments. An attacker can send fragments with many gaps, causing excessive buffering and memory exhaustion.

The WPO365 | Login plugin for WordPress up to version 43.2 is vulnerable to Cross-Site Request Forgery. The Ajax request verification can be disabled, allowing an unauthenticated attacker to overwrite arbitrary plugin options, including enabling the SCIM REST endpoint, setting a known SCIM token, and assigning administrator role to new users.

Chatwoot before version 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.

The default serve() path in Amazon aws-smithy-http-server lacks connection and header-read timeouts and a concurrent-connection cap, allowing remote attackers to cause a denial of service by opening many connections and sending partial requests.

Meshery before version 1.0.57 has an unauthenticated arbitrary file read vulnerability in the /api/system/fileView and /api/system/fileDownload endpoints. The file parameter is passed directly to os.Open without path validation, allowing reading arbitrary files from the host filesystem.

Out-of-bounds heap read vulnerability in PyTorch torchvision up to version 0.28.0 (fixed in commit 4e05dc2). The GIF decoder passes an unclamped length to memcpy, potentially leading to memory disclosure or denial of service.

Vanna through 2.0.2 has a path traversal vulnerability in FileSystemConversationStore. An unauthenticated attacker can write arbitrary JSON files and read conversation metadata outside the base directory using path traversal sequences in the conversation_id parameter.

In the Shopper admin panel (headless e-commerce) prior to version 2.8.0, three related defects were found: missing Locked attribute on Eloquent model identifiers in Livewire components allowed data tampering, plaintext password transmission via a hidden form field led to sensitive data disclosure, and the product barcode field was rendered without proper escaping, enabling persistent XSS.

The Easy Store extension (versions 1.0.0-2.0.1) for Joomla! allows unauthenticated attackers to forge payments and orders by processing client-side data. Attackers can manipulate payment and order states.

Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service.