CVE Vulnerability Catalog

MISP contains a path traversal vulnerability in OrganisationsController::getOrgLogo. The vulnerable code builds organisation logo file paths using organisation-controlled fields, allowing an attacker to access files outside the intended directory.

A stored XSS vulnerability exists in MISP when the Overmind theme is used. An authenticated user can store an arbitrary homepage value, including an XSS payload, leading to the execution of malicious JavaScript in the browser context.

A flaw in the visibility conditions in the MISP event template builder allowed authenticated non-site-admin users to view galaxies that should not have been visible to their organisation. The use of a PHP comparison expression instead of a query condition resulted in enabled galaxies, including organisation-only custom galaxies, being exposed.

ApostropheCMS, an open-source Node.js content management system, has a vulnerability in sanitize-html that allows dangerous URI schemes like 'javascript:' to pass through in HTML attributes. Versions prior to 2.17.5 do not block these schemes, leading to potential XSS attacks.

Discourse is an open-source discussion platform with a vulnerability in versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1. The DetailedTagSerializer#tag_group_names function returned all tag groups a tag belonged to without considering the user's visibility, allowing anonymous and unprivileged users to access the names of tag groups restricted to specific user groups.

Discourse is an open-source discussion platform that has a vulnerability in versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1. The MessageBus.publish call for /web_hook_events/<id> in Jobs::RedeliverWebHookEvents did not pass group_ids, allowing any authenticated user (or anonymous user when login_required is disabled) to access the channel.

Discourse, a discussion platform, has a path traversal vulnerability in backup handling that allows an authenticated administrator on one site in a multisite deployment to access backup files of another site. This issue affects versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1.

Discourse is an open-source discussion platform that had four authorization/disclosure issues in the chat plugin. Read-only category users could create chat threads, and self-deleted messages could be restored by their authors after channel access was revoked.

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip.

There is a vulnerability in the Discourse discussion platform that allows authenticated users to access hidden parent post content by using the AI 'explain' function on a reply to that post. This issue affects versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1.

Discourse is an open-source discussion platform where group owners, who are not necessarily admins or moderators, can view SMTP credentials in plaintext. This affects versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1.

A vulnerability in the Discourse discussion platform allows authenticated users outside the configured groups to post into staff-only whisper channels. This issue affects versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1.

Discourse is an open-source discussion platform that has a bug in the serialization of the :name attribute in GroupPostSerializer. The issue is that the incorrectly named predicate include_user_long_name? was never called, resulting in object.user.name always being serialized regardless of SiteSetting.enable_names.

Discourse is an open-source discussion platform with a vulnerability in versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1. The ReviewableQueuedPostSerializer unconditionally included payload["raw_email"] for posts arriving via email, allowing moderation group members to access the full email source without proper permissions.

Discourse is an open-source discussion platform that, in versions from 2026.1.0 to before 2026.1.4, from 2026.3.0 to before 2026.3.1, and from 2026.4.0 to before 2026.4.1, discloses whisper translation audit logs through bot debug endpoints. This issue has been patched in versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1.

ApostropheCMS is an open-source Node.js content management system. Versions of the @apostrophecms/cli package up to and including 3.6.0 contain a command injection vulnerability in the apos create command, allowing execution of arbitrary commands on the host system.

A vulnerability in HashThemes Hash Elements allows unauthorized access to sensitive system information. This affects versions from n/a through 1.5.4.

In MISP, an improper authorization vulnerability allowed an organization administrator to access user settings belonging to site administrator accounts within the same organization. The access control checks did not exclude higher-privileged site administrator users, enabling modification of site administrator account settings.

In versions prior to 0.47.2, a local privilege escalation vulnerability exists in Kitty's file transmission protocol. A child process running in the terminal can write to arbitrary files on the filesystem by exploiting a TOCTOU race condition between symlink validation and file creation.

Koel is a free, open-source music streaming solution. Prior to version 9.7.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the radio station creation endpoint, allowing the server to be coerced into making requests to arbitrary internal hosts.