CVE Vulnerability Catalog

Froxlor before version 2.3.8 contains a SQL Injection vulnerability in the Admins.add and Admins.update endpoints, where an attacker-controlled ipaddress array is stored and later concatenated into a SQL IN clause without parameterization. An authenticated administrator with change_serversettings permission can exploit this to retrieve arbitrary database data, including admin credentials.

Froxlor before version 2.3.8 contains a Stored XSS vulnerability in DNS TXT record content, which is not properly escaped before rendering in the admin panel. An authenticated customer with DNS editor access can inject JavaScript that executes in the administrator's browser session.

Vulnerability in linuxfabrik-lib before version 4.2.0. The db_sqlite.py module created SQLite databases at predictable paths in /tmp and followed attacker-created symbolic links. An attacker with a local monitoring account can create a symlink and trigger a sudo-authorized plugin, leading to arbitrary path overwrite, denial of service, or manipulation of an existing database. Fixed in version 4.2.0.

Blueprint Studio before version 2.5.2 returns raw exception strings in API responses to authenticated Home Assistant users. Some exception messages may contain internal filesystem paths or implementation details. The disclosed information could help an authenticated user fingerprint a Home Assistant installation and refine follow-up attacks.

Blueprint Studio before version 2.5.2 in the legacy stateless terminal command execution path accepts a cwd working-directory parameter and checks only whether the directory exists, without requiring it to remain inside the Home Assistant configuration directory. An administrator using the restricted terminal helper could select an existing directory outside the intended configuration boundary. Commands could then access or modify host paths permitted by the Home Assistant container and filesystem permissions, weakening the helper's expected filesystem restriction.

Blueprint Studio before version 2.5.2 in terminal SSH key authentication writes SSH private-key material to a file under the Home Assistant configuration directory before applying restrictive permissions and relies on best-effort cleanup. The key could temporarily remain on disk and could persist if cleanup failed or Home Assistant crashed. A user or process with filesystem access to the Home Assistant configuration directory could obtain the residual private key.

Blueprint Studio before version 2.5.2 contains a command injection vulnerability in the Git credential helper, where username and token are interpolated without validation. An attacker who can set Git credentials can inject shell commands, leading to arbitrary command execution with Home Assistant privileges.

Blueprint Studio before version 2.5.2 configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials file for the user running Home Assistant. Tokens could remain outside Blueprint Studio's intended Home Assistant storage and be read by other users or processes with access to the same filesystem context. The persistent helper configuration also affected later Git operations beyond the immediate Blueprint Studio action.

Blueprint Studio before version 2.5.2 fails to consistently enforce admin-only authorization boundaries, allowing any authenticated user to access admin-intended backend API actions. This includes invoking Home Assistant services, modifying configuration files, accessing streams, and uploading files.

Linuxfabrik Monitoring Plugins before version 5.1.0 contains a vulnerability in the sudo policy that allows the nagios or icinga account to execute /usr/bin/apt-get as root without argument restrictions. An attacker controlling that account can use the APT::Update::Pre-Invoke option to execute arbitrary commands with root privileges, leading to full host compromise.

Froxlor before version 2.3.7 contains a vulnerability in the API authentication path that does not require a second factor (2FA) for accounts with two-factor authentication enabled. An attacker who obtains an API key and secret can access API functions without providing the TOTP code, potentially exposing or modifying customer data, domains, email and FTP accounts, databases, DNS records, and certificate material.

Koha before versions 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafted HTML or script content in fields such as title, author, isbn, publishercode, place, collectiontitle, itemtype, and note, which are stored without sanitization and later rendered in the suggestion list template, causing injected scripts to execute in the browser of any staff user who views the suggestions.

fastify before version 5.12.1 is affected by a schema validation bypass when a request body schema targets a root primitive value. When the schema validates a top-level primitive such as an integer, Ajv can coerce a JSON string into the expected type during validation, but Fastify does not replace the root request body with the coerced value, so the route handler receives the original unvalidated string. As a result, a request that should have failed validation can reach application logic with a value that does not satisfy the schema, which can undermine integrity and access-control checks that rely on the validated type.

fastify from 5.8.3 up to but not including 5.12.1 has a vulnerability related to insufficient protection of forwarded headers when using the numeric form of trustProxy. The guard added in the fix for CVE-2026-3635 checks the connecting address, but the hop-count form compiles to a predicate that structurally ignores the address, so the guard is always satisfied for any hop count of one or more. Applications configured with a numeric trustProxy value, such as 1, remain vulnerable: an attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the forwarded request fields exactly as in the unpatched version. The impact includes host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning.

Keycloak contains a vulnerability in the legacy account-linking endpoint, where the protection mechanism based on a hash can be predicted by a malicious OIDC client. An attacker can forge a linking URL to connect the victim's account to an attacker-controlled external identity, leading to full account takeover.

A vulnerability in Zephyr RTOS's PTP receive handler allows a remote attacker to trigger an out-of-bounds read by sending a crafted PTP packet with an invalid message type (0xE or 0xF). The lack of an upper-bound check on the msg_size[] array index leads to reading beyond the array and subsequent memory operations, potentially causing a crash or limited memory corruption.

A vulnerability in the Zephyr kernel affects the k_thread_join() and k_thread_abort() system calls. An error in access validation (thread_obj_validate()) allows an unprivileged user thread to invoke these functions on a thread object it does not own. Instead of terminating the offending thread, execution reaches undefined behavior, potentially causing a kernel crash (on Clang) or an access-control bypass (on GCC).

Pydio Cells 5.0.0 through 5.0.2 exposes share-link details to any authenticated user. The REST handler for GET /a/share/link/{Uuid} lacks authorization checks, and the workspace UUID is not secret as it is embedded in the public page. An attacker with a standard user role can obtain the link hash, URL, owner ID, hidden login, permissions, download limits, target users, expiry, and password-required flag.

Amazon ion-java before version 1.12.0 improperly handles highly compressed data in the GZIP auto-decompression handler, which may allow remote actors to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression.

Amazon ion-java before version 1.12.0 has uncontrolled memory allocation in the binary Ion stream cursor, which may allow remote actors to cause a denial of service via a crafted Ion binary document containing a declared-length field that causes excessive heap preallocation.