CVE Vulnerability Catalog

Novu before version 3.18.0 accepts notification redirect URLs without validating the URL scheme, allowing javascript: in the redirect attribute. When a recipient clicks the notification, JavaScript can execute in the app context, potentially exposing session data.

Vulnerability in Apache Calcite Avatica allows unsafe reflection, where externally-controlled input can lead to initialization of arbitrary classes. This may result in execution of static initializer blocks in classes present in the classpath. Affects versions before 1.29.0.

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connect_tcp() and TLSStream.wrap() can validate internationalized host names after the standard library converts them with IDNA 2003 instead of IDNA 2008. When a connection to a non-ASCII domain is hijacked or redirected, an attacker can obtain a legitimate certificate for the different ASCII hostname produced by IDNA 2003 and present it to the client, causing the malicious endpoint's certificate to validate.

9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper trust the client-supplied X-9r-Real-Ip header in src/dashboardGuard.js when isLocalRequest decides whether canAccessPublicLlmApi may skip API-key validation for /api/v1/* routes. A remote unauthenticated attacker can set X-9r-Real-Ip to 127.0.0.1 and be classified as a local client, including on the verified GET /api/v1/models route. This issue is fixed in version 0.5.6.

In MISP's UsersController login(), the pre-auth query for TOTP verification did not include the User.disabled column, so the disabled flag was not checked in that branch. Although later identify() validation still rejects disabled accounts, a TOTP-enabled user can proceed to the verification step.

In MISP, the __uploadLogo method in OrganisationsController processes a caller-supplied tmp_name with filesystem probes before verifying it is a real upload. An authenticated site-admin can supply an arbitrary server file path, allowing to check for file existence and determine image types.

In MISP, the __statisticsOrgs method uses the organization name directly as a file path component when checking for logo existence. Although the target directory does not exist, the pattern is a path traversal weakness that could allow probing arbitrary files if the directory existed.

The findOrgImage method in MISP constructs a file path from an organization identifier without validation, allowing path traversal. An authenticated user with ability to create or import events can set an organization name with traversal sequences, enabling arbitrary file existence probing and limited file read for .png or .svg extensions.

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group (SG) editor role can trigger this code path, allowing them to modify organization metadata that should be restricted to site administrators or users with sync permissions.

In MISP, the EventReport::uploadPicture method processes a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(), and exif_imagetype() on the supplied path before verifying that the value was a genuine PHP upload via is_uploaded_file(). An authenticated user holding the perm_add permission could supply an arbitrary filesystem path as the tmp_name value. The application would then probe that path and return distinct validation error messages depending on whether the file existed, its MIME type, or its image format, allowing enumeration of file existence and type.

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission ('*') in the ACLComponent, making it accessible to any authenticated user regardless of their assigned permissions. All analogous report-modification actions correctly required the perm_add permission, while read-only actions such as downloadAsPDF appropriately used the wildcard.

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $_CMS['site'] results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability has been found in JosephChuks php-file-manager-with-code-editor up to 3.0. Impacted is the function file_put_contents of the file codeEditor.php of the component Save Handler. The manipulation of the argument filename/content leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.

SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestrator's DiffusionServer binds an unauthenticated ZeroMQ ROUTER socket to a network interface and passes the final frame of received multipart messages directly to pickle.loads() before any validation occurs.

In FasterXML jackson-core, the NumberInput.looksLikeValidNumber() method uses regular expressions to validate stringified numbers. Due to overlapping quantifiers in the PATTERN_FLOAT regex, matching cost grows quadratically with input length. An attacker can supply a long JSON string that is coerced to a numeric type, exhausting the server's request-handling threads.

An improper restriction of rendered UI layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions and 7.4 all versions may allow an attacker to cause information disclosure via a remote unauthenticated attack.