CVE Vulnerability Catalog

Midday allows any team member to delete the team. The delete procedure authorizes the caller with a helper that returns true for every membership row regardless of role. Neighboring procedures check the role and refuse non-owners, but deletion lacks this check. Any invitee can remove the team and all scoped records, and the cleanup job uses stored bank-connection tokens against connected providers.

Netmaker disables certificate verification on the connection to the configured mail server. The skip-verify field is set to true unconditionally, allowing the client to accept any certificate, including one from an interposing party. Mail sent by Netmaker includes password-reset messages with single-use tokens and user invitations with enrolment links, which can be intercepted.

Automatisch reveals whether an address is registered through the response to its forgot-password request. The route is mounted without authentication and without rate limiting, allowing account enumeration.

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. This service allows reading and writing gflags, enabling an attacker to change daemon behavior without restart.

IDURAR ERP CRM changes the password of whichever account a request names rather than the account making the request. The update handler resolves the authenticated user from the token but issues the update against a filter built from the URL identifier, without comparing them. The route is behind an administrator token check only, so any admin session suffices. The sole guard rejects a single hardcoded demo address. An attacker can set an arbitrary password on any other admin account and sign in as it.

Mage AI does not confine the paths accepted by its browser-items API to the project directory. A user with the Viewer role, which grants read access within the project, can read any file the server process can read by supplying an absolute path. Users with the Editor role can also write outside the project directory.

OpenMetadata accepts a caller-supplied post-authentication redirect target and appends the issued token to it. SamlLoginServlet reads the callback parameter and stores it in the session without validation, and the assertion consumer later formats it into a URL with the JWT and account details. The OIDC and OAuth2 handlers follow the same pattern. An attacker can craft a link that, after victim login, sends the token to an attacker-controlled destination, allowing account takeover.

ZLMediaKit confines the downloadFile API to configured root directories with a prefix comparison that does not account for directory boundaries. A requested path is accepted if it starts with the configured root, allowing reading files from similarly named directories. The API secret is required, but the reference container runs the server as root.

one-api gates one of its two channel-pinning paths and not the other. The API key suffix path requires admin check, but the URL path parameter branch has no role check. The route is behind token authentication only, so any valid token holder can reach it. The value flows to the distributor, which loads the channel by ID without scoping, and sets the Authorization header to that channel's key. A low-privilege account can pin any channel, sending requests with an operator-configured provider key, bypassing group restrictions and model allowlists.

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.

bestzip builds the argument list for the system zip utility without separating options from operands. The destination archive path and source paths are passed without a -- delimiter, so any source entry starting with a hyphen is interpreted as an option. zip accepts -T to test the archive and -TT to name the test command, so a source list containing those and a command string causes zip to run that command via shell. An application passing untrusted file names to bestzip can execute arbitrary commands.

FiftyOne renders a dataset field's description as markup. The sidebar field-information component passes the description to dangerouslySetInnerHTML without sanitization, allowing stored markup to execute on hover. Since the description is stored in the schema and travels with exported datasets, opening a dataset from another party can run malicious scripts in the app's origin.

DebugKit for CakePHP applications has a vulnerability in the MailPreview feature that allows an attacker to execute arbitrary class constructors. The attack requires access to DebugKit with debug mode enabled and an allowed hostname.

SunEditor before 3.1.4 has a vulnerability in the Embed plugin that allows JavaScript execution in the editor. The plugin parses raw embed HTML and recreates external script elements, leading to XSS. If an application stores or reflects content without additional sanitization, an attacker can trigger stored or reflected XSS.

SENAITE.CORE, the core framework for the SENAITE laboratory information management system, contains a vulnerability allowing unauthenticated remote code execution. Missing authorization in JSON API routes and unsafe use of eval() on input data enable an attacker to execute arbitrary Python code.

Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contain a CSRF vulnerability in cmd.cgi. The double-submit cookie protection can be bypassed when no Cookie header is present by supplying matching NagFormId and nagFormId values in the POST body.

Nagios Core before 4.5.12 contains a CSRF vulnerability in cmd.cgi where the CSRF protection passes validation when the NagFormId cookie is absent. Attackers can craft a malicious cross-site POST request to execute arbitrary Nagios commands as an authenticated user.

A vulnerability in the Linux kernel block subsystem was found where the timeout timer is not stopped when releasing a disk that was never added (e.g., after a failed probe). This leads to a use-after-free in the timer mechanism, potentially causing system crashes or privilege escalation.

In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors. After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the receive queue do not trigger forward-allocated memory reclaiming. Prevent forward memory from growing unboundedly in pathological drop scenarios by explicitly reclaiming memory when skbs are dropped.

In the Linux kernel's MPTCP module, a vulnerability was found due to lack of rejection of mutually exclusive incoming MPTCP suboptions. An attacker can send a packet with a combination of suboptions that according to RFC 8684 cannot coexist, potentially leading to unexpected network stack behavior. The fix introduces validation consistent with outgoing rules, ignoring invalid combinations.