CVE Vulnerability Catalog

PraisonAI before version 4.5.115 exposes the A2U (Agent-to-User) event stream server without authentication. The create_a2u_routes() function registers endpoints /a2u/info, /a2u/subscribe, /a2u/events/{stream_name}, /a2u/events/sub/{id}, and /a2u/health with no access controls.

The mcp-from-openapi library in FrontMCP prior to version 2.3.0 does not restrict $ref dereferencing in OpenAPI specifications, enabling SSRF and local file read attacks when processing untrusted specifications.

In OpenTelemetry-Go from 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use an absolute path but left the BSD kenv command using a bare name, allowing the same PATH hijacking attack on BSD and Solaris platforms.

kcp before versions 0.30.3 and 0.29.3 exposes the cache server directly via the root shard without authentication. Anyone with access to the root shard can read and write to the cache.

A command injection vulnerability in the HTTP Interface component of idachev mcp-javadc up to 1.2.4. Manipulating the jarFilePath argument leads to OS command injection. The attack is remotely exploitable and the exploit is publicly available.

In Kamailio (formerly OpenSER and SER) prior to versions 6.1.1, 6.0.6, and 5.8.8, an out-of-bounds access vulnerability exists in the core. A remote attacker can send a specially crafted TCP packet, causing a process crash (denial of service). This affects Kamailio instances with TCP or TLS listeners.

Tophat before version 2.5.1 is vulnerable to remote code execution via crafted tophat:// or http://localhost:29070 URLs. The arguments parameter is passed unsanitized to /bin/bash -c execution, allowing an attacker to execute arbitrary commands on a developer's macOS workstation.

LiquidJS before version 10.25.3 has a vulnerability that allows reading arbitrary files. Although root is set to constrain access, top-level file loads do not enforce that boundary. A Liquid instance configured with an empty temporary directory as root can return the contents of arbitrary files.

InvenTree before versions 1.2.7 and 1.3.0 allows authenticated users to fetch files from arbitrary URLs (remote_image) without internal IP validation. An attacker can use this for internal network scanning or SSRF attacks.

LiquidJS before version 10.25.3 has a path restriction bypass vulnerability in {% include %}, {% render %}, and {% layout %} directives. The containment check is path-based, not realpath-based, so a symlink inside the allowed root pointing outside bypasses the restriction.

Vulnerability in InvenTree from 0.16.0 to 1.2.7. Any authenticated user can create a valid API token for any other user, including administrators, by supplying the target's user ID in a POST /api/user/tokens/ request. The token is immediately usable for full API authentication.

InvenTree is an Open Source Inventory Management System. Prior to 1.2.7 and 1.3.0, a non-staff authenticated user can elevate their account to a staff level via a POST request against their user account endpoint. The write permissions on the API endpoint are improperly configured, allowing any user to change their staff status. This vulnerability is fixed in 1.2.7 and 1.3.0.

A denial of service vulnerability in React Server Components (react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack) versions 19.0.0-19.0.4, 19.1.0-19.1.5, and 19.2.0-19.2.4. Specially crafted HTTP requests to Server Function endpoints cause excessive CPU usage for about a minute, ending in a catchable error.

Immich before version 2.7.0 has a Stored XSS vulnerability in the 360° panorama viewer. An authenticated user can upload a malicious image whose OCR text is rendered unsanitized, allowing arbitrary JavaScript execution in other users' browsers.

LORIS versions 24.0.0 through before 27.0.3 and 28.0.1 have a vulnerability due to incorrect order of operations in FilesDownloadHandler, allowing an attacker to escape intended download directories.

Saleor is an e-commerce platform. From 2.0.0 to before 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118, a malicious actor can include many GraphQL mutations or queries in a single API call using aliases or chaining multiple mutations, resulting in resource exhaustion. This vulnerability is fixed in 3.23.0a3, 3.22.47, 3.21.54, and 3.20.118.

LORIS (Longitudinal Online Research and Imaging System) before versions 27.0.3 and 28.0.1 contains a reflected cross-site scripting vulnerability in the help_editor module due to improper sanitization of user-supplied variables. An attacker can trick a user into following an invalid link, potentially resulting in script execution in the victim's browser. The same vector can also allow an attacker to download arbitrary markdown files on an unpatched server.

Zammad before version 7.0.1 has a server-side template injection (SSTI) vulnerability leading to remote code execution (RCE) via the AI Agent. Impact is limited to environments where an attacker can control type_enrichment_data (typically high-privilege administrative configuration).

Zammad before versions 7.0.1 and 6.5.4 allows unauthenticated attackers to access the 'getting started' endpoint, which exposes sensitive internal entity data even after system setup is complete.

In LORIS (Longitudinal Online Research and Imaging System) from version 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router allows an attacker to traverse outside the intended directory and download unintended files through the static, css, and js endpoints. This vulnerability is fixed in versions 27.0.3 and 28.0.1.