CVE Vulnerability Catalog

Wekan from 9.57 until 9.74 contains a vulnerability in the /api/boards/:boardId/exportExcel route where the authorization guard exporterExcel.canExport(user) is not awaited. The returned Promise is always truthy, so exporterExcel.build(res) runs even when board.isVisibleBy(user) would deny access, allowing any authenticated non-member to download private board data. Fixed in version 9.74.

Wekan is open source kanban built with Meteor. From 8.36 until 9.74, the outgoing webhook Integration URL validator in models/integrations.js checked only the literal URL.hostname against regular expressions, so DNS names such as 169-254-169-254.nip.io passed that first-line check. The delivery path's fetchSafe guard already blocked the reported IPv4 destination, but its separate IPv4-only resolver and duplicated blocklist created inconsistent all-address-family enforcement and drift risk between input-time and connection-time validation. Version 9.74 makes server/lib/ssrfGuard.js resolve all addresses with `dns.lookup({ all: true })`, validate every result through the shared isIpBlocked logic, pin the connection, and block redirects. This issue is fixed in version 9.74.

pfSense Plus before 26.07 and pfSense CE through 2.8.1 contain a stored cross-site scripting vulnerability in the Traffic Graphs top-talkers feature, where PTR records are incorporated without sanitization into AJAX responses and rendered as HTML. An attacker who controls a PTR record and generates sufficient traffic can execute arbitrary JavaScript in an administrator's browser, gaining access to the authenticated session and enabling account creation and arbitrary OS command execution.

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows an attacker to execute arbitrary OS commands by chaining authentication bypass, CSRF validation bypass, and unsanitized command execution.

Logto Tunnel before version 0.3.9 contains a path traversal vulnerability in createStaticFileProxy. An unauthenticated attacker can send a request with a path containing '../' and read files outside the configured static directory if the tunnel port is reachable.

Logto, the modern open-source auth infrastructure, versions 1.40.1 to 1.41.0, has a vulnerability in GitHub Actions workflow where the pull request title is directly interpolated into an echo command in the commitlint step. A title containing a single quote can terminate the echo string and append arbitrary shell commands on the runner. An attacker can disrupt the ephemeral workflow execution, but repository secrets are not exposed.

Logto before version 1.41.0 has a catastrophic backtracking vulnerability in the regular expression used for email subaddressing blocking. An attacker can send a specially crafted email address, causing an event-loop stall and making authentication services unavailable.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.1, BuildKit read attacker-controlled /etc/passwd and /etc/group files without an upper bound while resolving a username to a user identifier or group identifier in executor/oci/user.go and solver/llbsolver/ops/user_linux.go. A malicious base image or build could provide oversized files that exhausted memory during user resolution and caused out-of-memory termination of the buildkitd process. This issue is fixed in version 0.31.1.

BuildKit, a toolkit for building artifacts, prior to version 0.31.1 has a vulnerability where a custom frontend can place an invalid SecurityMode value in a crafted build request. The executor treats this value as a non-sandbox mode without requiring the security.insecure entitlement, disabling Seccomp and AppArmor protections for the build container while Linux capabilities remain restricted.

Etherpad, a real-time collaborative editor, prior to version 3.3.0 has a stored XSS vulnerability in getHTMLFromAtext where values from the exportHtmlAdditionalTagsWithData plugin hook are interpolated into span data attributes without HTML attribute escaping. A pad editor can place an attacker-controlled value into the attribute pool, and opening the HTML export executes the script in the Etherpad origin.

Etherpad from version 2.1.0 to 3.1.0 contains an authorization vulnerability in the API that allows a non-admin user with a valid token to invoke administrative functions such as modifying, deleting, or disclosing pads.

Etherpad versions 2.6.0 to 3.1.0 have a vulnerability in the token transfer mechanism where an author token is stored and exposed via GET /tokenTransfer/{uuid} without expiration or removal after redemption. An unauthenticated attacker who obtains the UUID can repeatedly redeem it, receive fresh author cookies, and impersonate the author.

Etherpad versions 2.1.0 to 3.1.0 use the attacker-controlled x-proxy-path header when substituting paths into HTML, JavaScript, and CSS under /admin without sanitization, Vary, or Cache-Control. A shared proxy or CDN can cache the response and serve attacker-injected script to an administrator. Version 3.0.0 also accepts a protocol-relative x-proxy-path value, allowing redirection to an attacker-controlled host.

Etherpad prior to version 3.1.0 generates temporary filenames using Math.random() and places them in the system temp directory. A local attacker who predicts the filename can create a symbolic link to a file writable by the Etherpad process, allowing overwrite with partially attacker-controlled content during import or export.

Etherpad before version 3.3.1 contains an XSS vulnerability in the import functionality that allows a user with write access to a pad to store malicious markup that executes when other users, including administrators, open the pad.

Lemmy, a link aggregator and forum for the fediverse, versions 0.19.18 to 0.19.19 and 1.0.0-alpha.20, allows a community moderator to feature or unfeature posts in other communities via federated CollectionAdd and CollectionRemove activities. Lack of verification that the post belongs to the community enables manipulation of other communities' content.

OZOLS on Windows before version 1.1.1233 contains a vulnerability related to downloading code without integrity checks, including functionality from an untrusted control sphere, and cleartext transmission of sensitive information, caused by an abandoned auto-update domain.

Improper input validation in `ajaxSet_wireless_network_configuration.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows an authenticated attacker to cause denial of service via a crafted `ssid_number` parameter.

Heap-based buffer overflow in the multipart form-data parser in `jst_post.c` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause memory corruption and denial of service, and potentially execute arbitrary code, via a crafted multipart/form-data request.

Uncontrolled resource consumption in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote unauthenticated attacker to cause denial of service via excessively large password values.