CVE Vulnerability Catalog

In LobeChat version 1.136.1, the web-crawler package allows server-side request forgery (SSRF) in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array with impls containing the value naive, causing the server to fetch internal resources without validating private network addresses.

In Xpdf 4.05 (and earlier), a PDF object loop in a CMap, via the "UseCMap" entry, leads to infinite recursion and a stack overflow. This may cause an application crash when processing a malicious PDF file.

LibreNMS does not properly sanitize the alert rule name on the Alerts > Alert Rules page, allowing HTML code injection. The vulnerability is fixed in version 25.10.0.

PrestaShop Checkout (versions prior to 4.4.1 and 5.0.5) contains a vulnerability allowing hijacking of the target PayPal merchant account from the backoffice due to incorrect usage of the PHP array_search() function. The flaw is fixed in versions 4.4.1 and 5.0.5.

A vulnerability in Apeman ID71 EN75.8.53.20 affects a function in the /set_alias.cgi file. Manipulation of the alias argument leads to cross-site scripting (XSS). The attack can be executed remotely, and the exploit is publicly available.

A vulnerability in GNU Binutils 2.45 affects the vfinfo function in the ldmisc.c file. Manipulation leads to an out-of-bounds read. The attack can only be executed locally. The exploit is publicly available. The patch is called 16357.

Wykryto lukę bezpieczeństwa w GNU Binutils 2.45, dotyczącą funkcji tg_tag_type w pliku prdbg.c. Manipulacja tą funkcją prowadzi do braku kontroli wartości zwracanej, co może być wykorzystane w atakach lokalnych.

Mattermost versions 10.5.x <= 10.5.10 and 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons, allowing attackers to exploit timing oracles to perform byte-by-byte brute force attacks via response time analysis on Cloud API keys and OAuth client secrets.

Mattermost versions 10.5.x <= 10.5.10 and 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members. This allows guest users to add any team members to their private channels via the /api/v4/channels/{channel_id}/members endpoint.

Mailgen (Node.js package) through version 2.0.31 contains an HTML injection vulnerability in plaintext emails generated with the generatePlaintext method when user generated content is supplied. Tags with certain Unicode line separator characters are not removed, allowing unexpected HTML to remain in output.

In Reflex versions 0.5.4 through 0.8.14, the /auth-codespace endpoint assigns the redirect_to query parameter without validation and automatically clicks links on page load in GitHub Codespaces. This allows attackers to redirect users to arbitrary external URLs.

Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if they use keys sourced from (malicious) external parties in an unfiltered/unsalted way.

An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable of intercepting network traffic to obtain application metadata, including device information, geolocation, and telemetry data.

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing locally. The vulnerability affects the NTLM mechanism in Windows.

mailgen is a Node.js package that generates responsive HTML e-mails for sending transactional mail. Mailgen versions through 2.0.30 contain an HTML injection vulnerability in plaintext emails produced by the generatePlaintext method when user-generated content is supplied. The function attempts to remove HTML tags, but if tags are provided as encoded HTML entities they are not removed and are later decoded, resulting in active HTML (for example an img tag with an event handler) in the supposed plaintext output. In contexts where the generated plaintext string is subsequently rendered as HTML, this can allow execution of attacker-controlled JavaScript. Versions 2.0.31 and later contain a fix. No known workarounds exist.

CVE-2025-58903 in Fortinet FortiOS versions 7.6.0 through 7.6.3 and before 7.4.8 has an Unchecked Return Value vulnerability that allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specially crafted request.

A CWE-601 URL Redirection to Untrusted Site vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests. The issue affects multiple versions including FortiOS 7.6.0-7.6.3, 7.4.0-7.4.8, 7.0.x, 7.2.x, 6.4.x, FortiProxy 7.6.0-7.6.3, 7.4.x, 7.2.x, 7.0.x, and FortiSASE 25.2.a.

There is a vulnerability in Fortinet FortiOS and FortiProxy that allows for the insertion of sensitive information into log files. This affects FortiOS versions from 7.6.0 to 7.6.3 and all versions of 7.4, 7.2, 7.0, and 6.4, as well as FortiProxy from 7.6.0 to 7.6.3 and versions 7.4.0 to 7.4.13.

A vulnerability has been identified in SiPass integrated (All versions < V3.0). The affected server applications contain a broken access control vulnerability. The authorization mechanism lacks sufficient server-side checks, allowing an attacker to execute a specific API request.

The Pz-LinkCard WordPress plugin before version 2.5.7 does not validate a parameter before making a request to it, which could allow users with a role as low as Contributor to perform SSRF attacks.