CVE Vulnerability Catalog

Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthenticated attackers to guess identifiers. Guest orders lack ownership verification, enabling attackers to access order details including billing address, customer information, and purchased files by supplying a guessed uid parameter.

If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal.

A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal.

WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in the Gantt vacation chart API does not validate whether the requesting user is authorized to access the requested users' data. An authenticated attacker can supply arbitrary user logins in the selectedPeople parameter to view vacation schedules of other employees, including managers and staff from other offices, regardless of business logic access restrictions, resulting in unauthorized disclosure of sensitive scheduling information. This vulnerability was fixed in versions: 2025.2.1.177 and 2026.1.1.20.

Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0.

The WPGraphQL plugin for WordPress prior to 2.22.2 does not enforce object-level capabilities in the updatePost mutation. An authenticated Contributor can publish their own drafts without editorial approval or modify their own previously published posts despite lacking edit_published_posts.

The Solspace Freeform plugin for Craft CMS 5.x from 5.0.0 through 5.10.13 allows submitted values from public forms to be evaluated by the isolated Twig renderer when rendered into HTML attributes. An unauthenticated attacker can place Twig expressions in field values and receive evaluated PHP, OS, or Craft filesystem-path constants in the response.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Inclusion of Sensitive Information in Source Code vulnerability. An unauthenticated attacker with remote access could exploit it, leading to information exposure.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 and prior to 5.36 contain a Weak Encoding for Password vulnerability. A low-privileged attacker with local access could exploit it, leading to information disclosure, information tampering, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could exploit it, leading to unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access could exploit it, leading to information disclosure, information tampering, and protection mechanism bypass.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Insufficient Session Expiration vulnerability. A low-privileged attacker with adjacent network access could exploit it, leading to elevation of privileges, protection mechanism bypass, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization Decisions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Restriction of Rendered UI Layers or Frames vulnerability (clickjacking). A low-privileged attacker with remote access could exploit it, leading to elevation of privileges and session theft.

REDAXO prior to 5.21.2 in sync.php inserts filenames from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker able to place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission.

REDAXO prior to 5.21.2 in the mediaIsInUse() handler in media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when deleting media referenced by the type's effects.

REDAXO prior to 5.21.2 in rex_api_install_package_update in api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site.

REDAXO prior to 5.21.2 in rex_list::getSortColumn() in list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password.

The scim-patch library before version 0.9.2 has a vulnerability where navigate() and assign() improperly handle inherited properties when processing SCIM PATCH paths. An attacker can exploit properties like toString to mutate global process objects, affecting application logic.

Dell Secure Connect Gateway (SCG) Policy Manager before version 5.34.00.16 contains an improper privilege management vulnerability. A low-privileged attacker with remote access could gain unauthorized access.