CVE Vulnerability Catalog

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the WinGup decompress function joins untrusted ZIP entry names to unzipDestTo without canonical containment validation, allowing an entry such as ../mimeTools/mimeTools.dll to overwrite a DLL in a sibling plugin directory and execute attacker-controlled code when Notepad++ next loads that plugin. This issue is fixed in version 8.9.7.

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $( and ) into the fixed-size wchar_t str[MAX_PATH] stack buffer without bounding the m loop index, allowing a name of 260 or more characters to corrupt adjacent stack data, terminate the process through __report_gsfailure, and potentially execute code. This issue is fixed in version 8.9.7.

Notepad++ before 8.9.7 validates the backupFilePath attribute from session.xml with std::wstring::starts_with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode restoration to read an arbitrary user-readable file outside the backup directory into an editor tab.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

NetForensicMCP 2.1.0 has a vulnerability in the execAsync function of index.js, where manipulation of the interface/protocol argument can lead to command injection. The attack can be launched remotely, and the exploit has been published.

TIER IV Nebula through 1.2.0 contains an out-of-bounds read vulnerability in the Vlp32Decoder::unpack() function that allows unauthenticated remote attackers to read past the end of a received UDP buffer into adjacent heap memory by sending a short UDP datagram. Attackers can send a malformed datagram to the Velodyne UDP sensor port, which lacks sender-address restrictions present in other drivers, causing fabricated points derived from heap memory contents to be silently published into downstream PointCloud2 messages consumed by Autoware nodes.

This CVE record was withdrawn by its CNA. Further investigation showed that it was not a security issue.

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a user on a managed cluster to escalate their privileges by creating a Subscription with specific, crafted annotations. Successful exploitation grants the attacker the ability to deploy resources into any namespace with the elevated permissions of the controller's Service Account, potentially leading to unauthorized access and control over cluster resources.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE (versions before 04/2026) allows a remote attacker to obtain sensitive information and execute arbitrary code.

A blind SSRF vulnerability in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code by causing the server to retrieve an image from a crafted URL. The server does not return the content or errors directly, making detection difficult.

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manager role. This vulnerability enables unauthorized elevation of access levels.

An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbitrary code via a crafted .dll file. The vulnerability can be exploited to take control of the system.

Netatalk versions 3.1.19 through 4.4.2 contain a stack-based buffer overflow in the deletedir() function of the afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path construction. This allows unauthenticated attackers to perform an unbounded strcpy() operation with attacker-controlled filenames into a nearly full stack buffer. Version 4.4.3 patches the issue.

Certain HP Smart Tank All-in-One printers may be vulnerable to a denial of service condition that allows an unauthenticated attacker to cause the device to become unavailable by sending multiple concurrent HTTP requests.

HP has identified a potential vulnerability in HP Web Jetadmin (WJA) that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism.

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend.

Joomla Extension Sourcerer by Regular Labs before version 16.0.0 processes {source} blocks found in Joomla's final rendered HTML without reliably determining where that code originated, allowing unauthenticated remote code execution through unverified reflected user input.