CVE Vulnerability Catalog

An information disclosure vulnerability in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to obtain web session tokens. This requires a legitimate user to first click on a malicious link provided by the attacker.

An IPv6 packet processing vulnerability in the dataplane of PAN-OS allows an unauthenticated attacker to bypass firewall security policies, enabling blocked traffic to reach protected services. This issue affects only Palo Alto Networks firewalls, not Cloud NGFW or Panorama.

A vulnerability in Kyocera Command Center RX allows unauthorized export of the entire address book and bypass of data encryption, leading to disclosure of passwords and other sensitive information. The flaw affects multiple Kyocera TASKalfa printer models.

A vulnerability in LibreBooking allows an administrator to write an arbitrary file outside the template directory by manipulating the template name in the email editor, leading to remote code execution. Fixed in version 5.1.0.

Coolify prior to version 4.0.0-beta.469 contains a command injection vulnerability in the generate_healthcheck_commands() function. The health_check_host, health_check_method, and health_check_path parameters are directly interpolated into shell commands without proper sanitization, allowing authenticated users to execute arbitrary commands inside deployment containers.

A vulnerability in Hoppscotch before version 2026.6.0 allows an admin to execute arbitrary commands as root in the backend container. The attack involves manipulating the MAILER_SMTP_URL parameter in the updateInfraConfigs GraphQL mutation, which is then parsed by nodemailer into sendmail transport options.

In Hoppscotch prior to version 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field, while schema.prisma defaults isPublic to true. This causes mock servers linked to private collections to be publicly accessible without authentication, potentially exposing sensitive API data.

A vulnerability in Open WebUI before version 0.10.0 allows bypassing proxy path normalization by encoding the '../' sequence nine times in percent-encoded format. The _sanitize_proxy_path function decodes paths only eight times, enabling an attacker to access files outside the allowed directory.

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

In Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to achieve remote code execution (RCE) on the server. The vulnerability is patched in the mentioned versions.

In Open WebUI prior to 0.10.0, the WebSocket terminal URL was built from an unencoded session_id, allowing query injection to impersonate another user. The HTTP proxy also forwarded X-User-Id without integrity checks, enabling identity manipulation.

In Open WebUI before version 0.10.0 with Redis configured, real-time connection authentication (Socket.IO, WebSocket) used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating.

A vulnerability in Open WebUI before version 0.10.0 allows authenticated users to execute Python code or tools in another user's session. An attacker can exploit Socket.IO events to hijack a victim's session after learning their socket ID.

Open WebUI prior to 0.10.0 runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads using pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools.

In gpsd up to release 3.27.5 (fixed in commit 4c06658), a command injection vulnerability exists in the gpsprof tool. An attacker controlling the GPS device subtype value can embed backtick payloads in the gnuplot plot title, leading to arbitrary shell command execution when the victim renders the plot.

An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types.

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.

A stack-based buffer overflow vulnerability exists in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). An unauthenticated remote attacker can cause a denial of service by sending a crafted second SETUP request, crashing the RTSP service.

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The second-stage URL parser fails to validate the URL length, enabling an attacker to bypass first-stage validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service and making the device inaccessible to all clients on the local network.