CVE Vulnerability Catalog

Execution After Redirect (EAR) vulnerability in Apache Tomcat. Affects versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122; EOL versions 8.5.0-8.5.100 and 7.0.0-7.0.109 are also known to be affected.

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat: if OpenSSLLifecycleListener is configured for FIPS mode but FIPS activation fails, Tomcat logs an error but continues using JSSE in non-FIPS mode with the provided configuration. Affects versions 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122.

DrayTek Vigor2960 version 1.5.1.6 Revision 8218 has a vulnerability in /cgi-bin/mainfunction.cgi in the commonupload component, allowing unrestricted file upload via manipulation of upload_path/upload_name arguments. The attack can be performed remotely and the exploit has been publicly disclosed.

Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability in the administrative shell interface. An authenticated local attacker with restricted shell access can exploit this to bypass local security restrictions and gain root access on the device.

Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on October 17, and the list was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. The vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, and Thunderbird 153.5.1.

A denial-of-service vulnerability exists in the PDF Viewer component. The vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

An uninitialized memory vulnerability in the Audio/Video: cubeb component of Firefox and Thunderbird. The issue was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

A reflected cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation was found in the Ticimax E-Commerce Platform. The issue affects versions through 2026-09-02.

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability. When ALLOW_EXTERNAL_IMAGE_SOURCES is enabled, an attacker can send a crafted email with malicious alt text or URL values in an external image tag, leading to arbitrary JavaScript execution in the victim's session.

A flaw was found in cockpit-machines where the VNC console password is passed directly as a command-line argument to a system utility. A local unprivileged attacker on a host allowing cross-user process inspection could read the exposed password from the process list.

A flaw was found in cockpit-machines where RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval. A local unprivileged attacker on a system permitting cross-user process inspection can view these arguments.

A vulnerability was found in opensource-socialnetwork up to 9.11/10.1 affecting the input function in actions/administrator/cache/dynamic.php (Cache Settings component). Manipulation of host/port/username/password/type/status arguments leads to code injection, remotely exploitable, with a public exploit available. The patch is named 40945057cb451f0f35153110bc7e889c094400e1.

A vulnerability was found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android affecting the Class.forName function in ToggleGeneric.java. Manipulation of the Class argument leads to improper export of Android application components; local access is required. The exploit is public and version 9.0.90 addresses the issue.

A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Installer. Such manipulation of the argument plugin_file leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.0.1 can resolve this issue.

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, and SSH keys from the Dockhand container.

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another object's id parameter to alter courses, change quiz answers, and trash questions.

libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated.