CVE Vulnerability Catalog

libIEC61850 prior to 1.6.2 does not validate the length of the RptID field in the report-control-block write path, accepting values longer than 129 bytes. When a report is later serialized, the function passes the stack-backed buffer rptIdBuf[130] to MmsValue_setVisibleString, whose resize path frees that buffer, causing an invalid free and server crash.

The Discourse Doc Categories plugin prior to the verified source fix refreshes the doc category index by resolving linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the index topic can thereby learn titles they are not authorized to view.

In libIEC61850 from 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes the file handle in a task but leaves a stale non-NULL value in a task marked as unused. If a later ObtainFile request reuses that task and destination creation fails, the cleanup path closes the stale FILE object again, allowing a remote crash of the server.

In pupnp prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service.

In Open Zaak from 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row uses the attacker-controlled bestandspad CSV field without ensuring the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to copy any readable file into document storage.

In Open Zaak from 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_zoek do not filter result querysets according to the authorizations associated with the request token. A caller with a valid zaken.lezen or documenten.lezen token can retrieve case or document metadata outside the token's authorized types or confidentiality levels.

An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of a heap-allocated buffer, allowing an attacker to disclose heap memory contents.

In SparkyFitness prior to 1.6.0, chatService.ts and labelScanService.ts do not validate destinations supplied in custom AI service settings. An authenticated user can save a custom AI service URL and invoke an affected AI flow, triggering an outbound request with a controlled bearer value.

Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings guard by setting transcodeHwAccel to custom and supplying attacker-controlled decodeFlags and encodeFlags, which are appended verbatim to the ffmpeg argument vector.

Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.

Cross Site Scripting vulnerability in InstantASP ltd InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code by reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding.

An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content through an unfiltered_html grant to the Customer role in all versions up to and including 3.0.1 due to insufficient input sanitization and output escaping. This requires WooCommerce to be active, but since the customer role is freely self-registerable without admin approval, exploitation is effectively possible by any unauthenticated visitor who registers a WooCommerce account. The stored payload is returned unsanitized via the unauthenticated GET /wp-json/wp/v2/comments REST endpoint and post/comment RSS feeds, exposing headless clients, feed readers, and third-party widgets.

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input.

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.

The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token – but without further authentication or authorization – to distinguish valid ID values from the full 10-digit numeric search space. Combined with the absence of meaningful rate limiting on this endpoint, this discrepancy constitutes an enumeration oracle, enabling an attacker to discover registered devices at scale.

A flaw was found in luksmeta involving improper boundary validation of metadata slots. An attacker able to supply or modify a disk header can redirect wipe or load operations outside the intended metadata area, overwriting or zeroing out encrypted payload data and causing persistent data loss.

The YITH PayPal Express Checkout for WooCommerce plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.61.0.