CVE Vulnerability Catalog

Joomla! Core versions 4.0.0-5.4.7 and 6.0.0-6.1.2 have a vulnerability related to inconsistent ACL checks for mutating webservice endpoints. An improper access check allows unauthorized users to perform mutation actions in webservice endpoints, where the same mutation was restricted in the backend UI.

The mise tool, managing developer tool versions, before version 2026.7.1 records mise/bin/mise with user and group ID 1001, and the installation process does not normalize ownership, allowing a local user with those IDs to replace the installed executable, especially when MISE_INSTALL_PATH targets a shared location like /usr/local/bin.

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without validating the target host against the expected Git provider. This URL is persisted in job extra variables and later used to send authenticated status updates. A user with admin role on a webhook-enabled job template can read the template's webhook signing key, forge a signed GitHub webhook payload with an arbitrary statuses_url, and cause AWX to POST status updates to an attacker-controlled or internal URL. The status update request includes the configured Git Personal Access Token (PAT) in the Authorization header, resulting in credential leakage to the attacker-specified endpoint.

Trivy, a security scanner, before version 0.72.0 uses plugin manifest metadata to construct paths under ~/.trivy/plugins without confining plugin names to that root, allowing an attacker who persuades a user to install or run a malicious plugin to write the manifest and plugin binary to arbitrary user-writable paths.

File Browser prior to 2.63.17 directly serializes the Link storage struct in sharePostHandler, shareListHandler, and shareGetsHandler, exposing password_hash and the bypass token in API responses. An administrator can retrieve these secrets for every user's shares, enabling offline password cracking and direct access to protected shares.

Dragonfly before version 1.40.0 has a vulnerability in CMS.INITBYDIM and CMS.INITBYPROW commands where an arithmetic overflow in buffer size calculation leads to undersized buffer allocation. This allows an unauthenticated remote client to corrupt or disclose adjacent heap memory and crash the server.

Kestra before version 1.3.24 has a stored XSS vulnerability in its custom Markdown parser. A user with permission to create or update a Flow description can inject JavaScript event-handler attributes via the [[link]] syntax, causing script execution when another user opens the description or information panel.

Vvveb before version 1.0.8.4 has a vulnerability in backend comment operations that allows a low-privileged Author to manage comments under another Author's posts. Lack of ownership verification enables reading comment content, email addresses, changing moderation status, editing or deleting comments.

Vvveb before version 1.0.8.4 has a vulnerability in backend post operations that allows a low-privileged Author to access posts owned by another Author. Lack of consistent ownership enforcement enables viewing metadata, duplicating or deleting posts, potentially exposing private drafts and causing data loss.

Vvveb before version 1.0.8.4 has a vulnerability in backend digital asset operations that allows a low-privileged Vendor to access digital assets linked to another Vendor's products. Lack of ownership boundary enforcement enables listing assets, reading names and file metadata, editing metadata, or deleting asset records.

MyBB, free and open source forum software, before version 1.8.40 in the User CP Buddy/Ignore List component does not validate reciprocal buddy-list updates correctly. Deleting an entry from the acting user's list updates the target account's buddy list, but the reciprocal search uses the deleted target UID instead of the acting user's UID, and the unchecked array_search() return value can be used as an array key, potentially removing the target account's first stored buddy.

The registration component in MyBB does not validate the text-based Security Question CAPTCHA correctly, allowing attackers to bypass the challenge via a specially crafted value. The question_id field is accepted without verifying if the identifier is valid, and if it is blank, forged, or expired, the request continues without a question-related error.

MyBB before version 1.8.40 does not consistently enforce single-use semantics for the built-in CAPTCHA, allowing remote attackers to bypass CAPTCHA controls through challenge replay. The successful validation paths in contact.php, member.php?action=do_resendactivation, member.php?action=do_lostpw, member.php?action=do_emailuser, and sendthread.php?action=do_sendtofriend do not call captcha::invalidate_captcha() for the default CAPTCHA.

MyBB before version 1.8.40 in the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The action=recovery_codes page regenerates Two-Factor Authentication recovery codes on GET requests without request forgery protection.

MyBB prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control changes the administrator's default view on GET requests without request forgery protection.

MyBB prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route duplicates archived mailing entries into new drafts on GET requests without request forgery protection.

MyBB prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions without verifying the my_post_key token.

MyBB before version 1.8.40 in the Email User controller does not sanitize sender names correctly, resulting in mail header injection. The fromname parameter is accepted without sanitization, and when mail_handler is set to the default PHP mail value, the sender name is used in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences.

MyBB before version 1.8.40 in the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts, and when no forums are in scope, the UPDATE query executes without the expected permission-based limitation.

MyBB before version 1.8.40 in the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses, and verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result for IPv6, allowing a crafted remote target to bypass the host restriction.