CVE Vulnerability Catalog

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, administratively privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier. A remote, unauthenticated attacker can reflect sensitive information in an HTTP response body.

Information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier. Under difficult to reproduce circumstances, a remote, unauthenticated attacker can reflect sensitive information in an HTTP response body.

Hydra before version 1.3.4 has an arbitrary code execution vulnerability. The hydra.utils.instantiate() function resolves and calls Python objects selected by configuration, allowing an attacker to invoke dangerous callables.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Atlantis versions 0.19.8 through 0.45.0 do not consistently validate user-controlled workspace values. This can allow escaping the intended workspace directory and performing filesystem operations outside it, leading to integrity loss or DoS.

Keystone, a content management system for Node.js, prior to version 6.5.3, contains a vulnerability in the findMany resolver that allows a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.

YOURLS, a self-hosted, customizable URL shortener written in PHP, from version 1.5.1 until 1.10.4 stores the HTTP Referer header and aggregates it in statistics, then passes it to the chart builder which concatenates labels into inline JavaScript without proper escaping. This allows an unauthenticated attacker to poison the statistics of an existing short URL with a crafted referrer, leading to execution of malicious JavaScript in the YOURLS origin when an administrator or public stats-page viewer opens the affected page. This issue is fixed in version 1.10.4.

Microsoft UFO, an open-source framework for intelligent automation, prior to version 3.0.8, contains an MCP server on localhost:8010 that does not validate Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas, and invoke execute_command with a valid UFO_MCP_API_KEY, allowing reading files or executing allowed OS commands as the victim's user. This issue is fixed in version 3.0.8.

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user, and `GET /ws/terminal/:id` and `GET /ws/file/:id` only check whether the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer data, or telemetry can attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. This issue is fixed in version 2.0.10.

Defuddle, an HTML page cleaner, prior to version 0.19.1, contains a vulnerability in site extractors that interpolate page-derived values (such as image alt and src, og:image, video descriptions) into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without DOM-based sanitization. A malicious page or attacker-controlled content can inject event-handler attributes or javascript URLs that execute when the extracted HTML is rendered. This issue is fixed in version 0.19.1.

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools field flow through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression. An unauthenticated remote attacker can influence that output through a crafted prompt and execute commands in the Xinference server process context. This issue is fixed in version 2.7.0.

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.

Miniflux 2 prior to 2.3.1 accepts redirect targets containing backslashes, which browsers normalize to forward slashes. An unauthenticated attacker can exploit this in the login flow to redirect a victim to an attacker-controlled external site, bypassing relative-path and host checks.

Runtipi in 4.10.0 and earlier accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during backup restore. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content, allowing writes outside the intended restore and user-config directory boundary with Runtipi process permissions.

TensorZero, an open-source LLMOps platform, prior to version 2026.6.0, contains a vulnerability in the /internal/object_storage endpoint that accepts a caller-supplied storage_path parameter, dynamically overriding the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound requests to attacker-chosen endpoints, including internal or cloud-metadata. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment. This issue is fixed in version 2026.6.0.