CVE Vulnerability Catalog

In hoppscotch before version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation.

Scoold prior to version 1.66.1 does not enforce authorization when deleting feedback – any logged-in user can delete another user's feedback by providing its ID. Object ownership or moderator privileges are not checked.

NocoBase prior to version 2.0.30 contains a vulnerability in the plugin-workflow-sql plugin, which substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL.

Ella Core, a 5G core for private networks, prior to version 1.8.0 panics when processing a NGAP handover failure message. An attacker can send such messages via gNodeB, causing service disruption for all connected subscribers.

vLLM from version 0.5.5 to before 0.18.0 defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This causes inconsistency between audio heard by humans and audio processed by AI models (e.g., via vllm, transformer). This issue is fixed in version 0.18.0.

Dataease SQLbot up to version 1.6.0 has a vulnerability in the function get_es_data_by_http in file backend/apps/db/es_engine.py of the Elasticsearch Handler component, allowing manipulation of the address argument leading to server-side request forgery (SSRF). The attack can be performed remotely. A fix is available in version 1.7.0.

XZ Utils before version 5.8.3 has a buffer overflow vulnerability in the lzma_index_decoder() function. Decoding an Index with no Records leads to insufficient memory allocation and a buffer overflow on subsequent lzma_index_append() calls.

In Open edX Platform from the maple release to ulmo, an unauthenticated attacker can fully bypass the email verification process. This exploits OAuth2 tokens issued to inactive users and the exposure of activation_key in the REST API response.

Copier before version 9.14.1 has a vulnerability in the _external_data feature that allows a template to load YAML files from template-controlled paths. A malicious template can read local YAML-parseable files accessible to the user and expose their contents in rendered output.

Copier before version 9.14.1 accepts parent-directory traversal (..) in the _subdirectory setting, allowing a template to escape its own directory and render files from the parent directory without the --UNSAFE flag.

OpenClaw prior to commit 8aceaf5 has a bypass vulnerability in shell-bleed protection, allowing attackers to execute blocked script content using pipes, command substitution, or subshells.

In macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7, an integer overflow was fixed with improved input validation. An app may be able to cause unexpected system termination.

An out-of-bounds access issue was fixed with improved bounds checking. Affected are iOS 18.6, iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a malicious media file may lead to unexpected app termination or memory corruption.

A vulnerability was found in Newgen OmniDocs up to version 12.0.00 in the file /omnidocs/WebApiRequestRedirection. Manipulation of the DocumentId argument leads to improper control of resource identifiers, enabling remote attack. The exploit is publicly available.

OpenSSH before version 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

Rack::Request incorrectly parses the Host header, accepting characters like /, ?, #, and @ that are not allowed in RFC-compliant hostnames. The req.host method returns the full unvalidated value, allowing bypass of host validation based on simple prefix or suffix checks.

In ewe (Gleam web server) prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting.

Vulnerability in the leancrypto cryptographic library (versions before 1.7.1). The lc_x509_extract_name_segment() function casts size_t vlen to uint8_t when storing the Common Name (CN) length, potentially leading to overflow and identity impersonation.

NanoMQ before version 0.24.10 has an out-of-bounds read vulnerability in the hook_work_cb() function in webhook_inproc.c. The cJSON_Parse function reads data from a buffer without a guaranteed null terminator, potentially accessing memory beyond the allocated buffer.

Frappe LMS is vulnerable to stored Cross-Site Scripting (XSS). The vulnerability affects versions from 2.27.0 to before 2.48.0.