CVE Vulnerability Catalog

Remote code execution vulnerability in the speech data explorer component of NVIDIA NeMo Speech. Malicious data could allow code execution, privilege escalation, information disclosure, and data tampering.

Remote code execution vulnerability in NVIDIA NeMo Speech. Malicious data could allow code execution, information disclosure, and data tampering.

Potential vulnerability in HP Support Assistant prior to version 9.55.10.0. Insufficient access controls could allow a local attacker to escalate privileges.

MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name is interpolated directly into a JavaScript string literal without proper output encoding, allowing injection of arbitrary JavaScript. The injected script executes in the context of any authenticated user who loads the page, potentially enabling session hijacking, data exfiltration, or privileged actions.

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. Due to a logic error in the readFile guard condition in the Xml::build() library, a request containing a bare HTTPS URL can be fetched by the server as a resource. An unauthenticated attacker can send a crafted POST request to the cspReport endpoint to cause the server to issue an outbound HTTPS request to an arbitrary target reachable from the server, enabling scanning of internal services or attacks on internal endpoints.

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials.

In MISP, the queryEnrichment method in EventsController.php accepts a module name and iterates over the list of enabled modules. If the module is not found, the code continues with default parameters instead of rejecting the request, allowing an authenticated user to trigger enrichment via a module that was not enabled, bypassing availability controls.

In MISP, the add() method in CollectionsController enforces sharing-group authorization only for POST requests, but CRUDComponent::add() persists data on both POST and PUT. An authenticated user can send a PUT request to collections/add to create a collection with distribution=4 (shared with a specific group) without proper authorization, bypassing the access control.

MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe that capture sensitive data including admin, database, GPG, and supervisor passwords. These files are created with the system default umask, resulting in world-readable permissions (typically 0644). Additionally, the log file is not removed before creation, allowing a pre-existing symlink to redirect writes to an arbitrary location. Affected versions are <2.5.47.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint, allowing an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}. Advisory ID: MMSA-2026-00771.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without hex-encoding flags, allowing an attacker to inject a single-quote character and execute arbitrary JavaScript. The vulnerability affects the Default and UiBeta themes; the Overmind theme is not affected by this specific sink.

Flaw in php-file-manager-with-code-editor up to 3.0. Manipulating the files argument in move_uploaded_file in filemanager.php leads to unrestricted upload. Attack can be executed remotely.

A vulnerability was identified in sfturing hosp_order up to commit 627f426331da8086ce8fff2017d65b1ddef384f8. An unknown function in HospitalController.java of the Public Search Handlers component is affected. Manipulation of the Search argument leads to cross-site scripting. The attack can be initiated remotely, and the exploit is publicly available. The project has not responded.

The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory. By sending a crafted AJAX request, they can obtain internal user IDs, usernames, and email addresses of all registered vendors, exposing personally identifiable information.

The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authenticated attackers with subscriber-level access or higher to duplicate any vendor's product by supplying an arbitrary product ID. Attackers can bypass ownership verification, copy any vendor's product listings including private metadata, and assign the duplicate to their own account without the victim's consent.

The MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticated attackers with subscriber-level access or higher to create refund requests against any order by supplying an arbitrary order ID. Attackers can submit crafted AJAX requests to create fraudulent refund requests against orders they did not place, causing marketplace disruption and unauthorized interference.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL Injection. This issue affects KarelIPS through 22092026.

MISP contains a reflected XSS vulnerability in the attribute histogram view. The $selectedTypes variable, derived from the URL path segment, is interpolated directly into a JavaScript array literal inside an onClick HTML attribute without encoding. An attacker who can cause an authenticated user to visit a crafted URL can execute arbitrary JavaScript in the victim's browser within the MISP origin. Affected version: <2.5.47.

MISP contains a reflected XSS vulnerability in the AnalystDataController::viewForObject action. The method accepts a parent object type parameter from the URL without validation and passes it to the Overmind-themed AnalystData thread view element, where it is interpolated into two translated strings and rendered without output encoding. An authenticated attacker can induce a victim to visit a crafted URL, allowing arbitrary JavaScript execution in the victim's browser within the MISP context. Affected version: <2.5.47.

MISP's WorkflowsController exposed the moduleStatelessExecution action in the Security component's unlockedActions list. In CakePHP, listing an action under unlockedActions disables both CSRF token check and field hash validation. Because moduleStatelessExecution executes a workflow module's exec() method with caller-supplied input and parameters, the absence of CSRF protection allows an attacker to craft a cross-site form post that, when submitted by an authenticated administrator, would invoke the action on the MISP instance. The attacker can select any workflow module, including action modules that write blocklist and warninglist entries, and supply arbitrary input. The vulnerability was found during internal review. The fix is included in MISP v2.5.47.