CVE Vulnerability Catalog

Lemur before version 1.9.2 has a vulnerability that allows authenticated users to influence the ACME authority URL (acme_url) without effective server-side destination restriction, enabling SSRF attacks on internal services or cloud metadata. Additionally, there is an authorization weakness that could preserve access to private keys after ownership changes.

NVIDIA Triton Inference Server for Linux contains a vulnerability that allows an attacker to perform path traversal, potentially leading to denial of service.

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the cache, relying only on CRC32 checksums. Attackers can substitute content, poisoning the cache with malicious container image layers or manifests that are then executed by other hosts.

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI Instructions feature served via the MCP server. Attackers can exfiltrate credentials from environment files and perform destructive file deletion on the victim's machine.

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass.

Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.

An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjunction with "execute_mode=PREPARE" parameter in the "run.php" endpoint.

An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary PHP code into the PreExecuteCode attribute of any report regardless of the safe_mode setting, leading to remote code execution.

In the libre library before version 4.8.1, the websock_decode() function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding. The expression 4 + hdr->len can wrap when hdr->len is close to UINT64_MAX, causing the mbuf_get_left() bounds check to pass. The subsequent XOR unmasking loop then writes beyond the heap buffer. Applications using websock_accept() or websock_accept_proto() to implement a WebSocket server are affected, and exploitation can cause attacker-controlled heap corruption or denial of service after the HTTP WebSocket upgrade handshake. This issue is fixed in version 4.8.1.

An issue exists in Epson iProjection.apk v3.2.6 for the EH-TW5350 projector. If you identify a projector equipped with an iProjection function, you can access the projector using hard-coded authentication information and control the projector maliciously.

A verification bypass vulnerability exists in EPSON 150075647YWWV110 EasyMP Network Updater Ver.1.20. The Epson projector can be updated by encrypted firmware through USB.

Dell PowerStore SDNAS contains an out-of-bounds write vulnerability in SMB/CIFS. An unauthenticated remote attacker can send a specially crafted SMB packet causing a crash (persistent if auto-restart is enabled) and potentially remote code execution.

authentik before versions 2026.2.6 and 2026.5.5 contains a vulnerability in SAML Source configuration with USERNAME_LINK or EMAIL_LINK user-matching mode. An attacker can inject an XML comment into NameID, leading to account takeover.

ePA 3.x Integration before version 1.3.0 contains a vulnerability in VAU server certificate validation. A network-positioned attacker can intercept the VAU handshake and impersonate the server, controlling session keys and reading or modifying encrypted traffic.

Red Hat Build of Keycloak contains a vulnerability in the reset-credentials flow of the keycloak-services component. An unauthenticated attacker can force the password reset process for any user without clicking the verification link, leading to account takeover.

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The rev parameter is passed unvalidated to git show, allowing arbitrary file writes.

Joomla! Core versions 1.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability of unrestricted uploads of SHTML files. The default list of dangerous files did not include SHTML files, which on servers that execute these files could lead to code execution.

MyBB before version 1.8.40 contains a vulnerability in the Contact module that does not properly validate redirect URLs, leading to open redirect and reflected JavaScript code injection.

MyBB from version 1.8.13 to 1.8.40 contains a vulnerability in the installer module that improperly escapes database configuration values, leading to PHP code injection and remote code execution.