CVE Vulnerability Catalog

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection and an account in one of the configured sources can log into any account.

BrowserStack Runner through version 0.9.5 has a remote code execution vulnerability in the /_log HTTP handler. An unauthenticated network-adjacent attacker can submit crafted JSON requests that are passed to vm.runInNewContext() with eval(), allowing escape from the Node.js sandbox and full remote code execution.

authentik, an open-source identity provider, prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, is vulnerable to XML Signature Wrapping in the SAML Source ACS endpoint when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertion to authenticate as another federated user.

Student Admission System 1.0 by code-projects contains an SQL injection vulnerability in the /index.php file via manipulation of the eid/did arguments. The attack can be carried out remotely, and the exploit has been published.

A vulnerability was detected in sayan365 student-management-system up to 7f3c9ce7d410332335c2affac93a385485051800. This impacts an unknown function. The manipulation results in improper authentication. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.

NI-PAL 26.3.0 and prior versions on Windows and Linux have an improper input validation vulnerability that may allow a local authenticated user to access arbitrary system memory, potentially leading to privilege escalation.

Improper input validation in the NI-PAL kernel driver may allow a local authenticated user to cause a denial of service by triggering a crash due to a NULL pointer dereference. This vulnerability affects NI-PAL 26.3.0 and prior versions on Windows and Linux.

An unauthenticated user with write access to the knowledge base can store an XSS payload in a knowledge base item in GLPI before version 11.0.7.

The ARMember Premium plugin for WordPress up to version 7.3.1 is vulnerable to SQL injection via the 'order' parameter of the 'arm_directory_paging_action' AJAX action. Insufficient escaping and lack of proper SQL query preparation in the `arm_get_directory_members()` function allow unauthenticated attackers to append additional SQL queries.

Medplum before version 5.1.14 has an SSRF vulnerability in the subscription worker, allowing authenticated users to perform unauthorized network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscriptions at internal addresses like cloud metadata services, databases, or container orchestration endpoints to exfiltrate IAM credentials and patient health records.

Vulnerability in the Tesla library for Elixir (versions 0.6.0 up to before 1.18.3) due to improper handling of highly compressed data (decompression bomb). HTTP responses are decompressed without size limits, and multiple compression layers can lead to exponential data expansion, causing memory exhaustion and denial of service.

In AIOHTTP prior to version 3.14.0, cookies set via the `cookies` parameter are sent after a cross-origin redirect. If a developer uses the `cookies` parameter per-request, sensitive data might leak to an attacker controlling the redirect.

React Router versions 7.0.0 through 7.14.x and @remix-run/server-runtime versions 2.10.0 through 2.17.4 contain a DoS vulnerability via unbounded path expansion in the __manifest endpoint. Attackers can send crafted requests that consume excessive server resources.

React Router versions 7.0.0 through 7.14.1 in Framework Mode can allow remote code execution (RCE) via external requests if the application has an existing prototype pollution vulnerability. Two-step attack. Does not affect Declarative or Data Mode.

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, the SAML source response processor (ResponseProcessor.parse()) does not validate the Conditions element on assertions. NotBefore, NotOnOrAfter, and AudienceRestriction are all ignored. This allows replay of expired assertions and acceptance of assertions intended for other service providers.

Client-side Cross-Site Scripting (XSS) vulnerability in React Router versions 7.7.0 through 7.13.1, occurring during RSC redirect handling from untrusted sources. Only affects applications using unstable RSC APIs.

React Router versions 7.7.0 through 7.13.1 contain a client-side Cross-Site Scripting (XSS) vulnerability in the RSC redirect handling if redirects come from untrusted sources. This only affects applications using the unstable RSC APIs. Patched in version 7.13.2.

SolarWinds Web Help Desk is affected by a denial-of-service vulnerability that can cause the server to crash due to insufficient memory.

The Content Visibility for Divi Builder plugin for WordPress up to version 4.02 contains a remote code execution vulnerability via the 'cvdb_content_visibility_check' parameter in the 'et_pb_text' shortcode. Authenticated attackers with Contributor-level access and above can execute code on the server.

Incorrect boundary conditions in the Graphics: Text component in Firefox. This vulnerability was fixed in Firefox 151.0.3.