CVE Vulnerability Catalog

An issue in MongoDB Server's aggregation framework can cause certain constant values to be handled incorrectly during internal query rewriting. Under certain conditions, an authenticated user with read access may receive field values in aggregation output that the query did not intend to return.

In Plane prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy boards, pass the user-controlled order_by parameter to Django's order_by without allowlist validation. An attacker can use double-underscore relationship traversal to reference arbitrary related model fields, revealing database schema details through errors and potentially disclosing field values through differential ordering. Fixed in version 1.4.0.

In self-hosted Plane deployments prior to 1.4.0, unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint expose the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. Fixed in version 1.4.0.

In JupyterLab from 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to resolve the current document rather than retaining the document whose command button was clicked. If another document becomes current while the prompt is open and the user chooses Trust, JupyterLab marks the second document trusted while leaving the clicked document untrusted. Later command buttons in the incorrectly trusted document run without a prompt, and trusting a notebook marks all cells trusted, saves unsaved edits, and persists the server signature to disk. Fixed in versions 4.5.11 and 4.6.4.

asteval, a Python expression evaluator for restricted execution, prior to 1.0.9 allows sandbox escape. With numpy enabled, the default Interpreter exposes a ctypes type and permits from_address memory access, while attribute assignments use unfiltered setattr. An attacker-controlled expression can read or corrupt process memory, execute code, or disclose secrets.

The vulnerability in Xen concerns the GNTTAB_cache_flush operation, where the error path after adding a NULL check fails to drop a page reference if the page is owned by a special system domain (DOM_IO or DOM_COW).

Electron applications on macOS using Squirrel.Mac-based automatic updates are vulnerable to a local race in the privileged ShipIt helper prior to 39.8.10, 41.10.5, and 42.0.0-beta.2. The helper did not bind the validated update target to one canonical application-bundle path, allowing a local attacker to redirect the root-level write and overwrite another application's files.

Axios versions 1.15.0 through 1.20.0 incorrectly treat NO_PROXY CIDR entries as textual hostname suffixes instead of network ranges. A request to an address covered by a CIDR entry in NO_PROXY is not matched and is sent through the configured proxy. For plaintext HTTP the proxy can observe and modify URLs, headers, and bodies; for HTTPS it can observe connection metadata and CONNECT requests.

The vulnerability in ProPhoenix Law RMS version v2022.2403.3.101 is a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint.

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.

Listed NETGEAR router models have insufficient input validation in the time server (NTP) setting. An attacker connected to the router's local network with administrator credentials can run unauthorized commands on the router. This impacts router integrity, with no impact on confidentiality or availability.

SFTPGo prior to 2.7.5 allows an authenticated SSH user to send a malformed protocol message while opening a channel, causing an unhandled error that terminates the server process and affects all connected users until restart. No confidentiality or integrity impact has been identified.

openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated but low-privilege SNMP user can invoke mapped backend operations as an administrative identity. In route_mapper/account.lua, get_user_privilege returns the complete nine-privilege set for a special_users group that includes the SNMPv1_v2c pseudo-user.

MCP Context Forge versions 0.2.0 through 0.3.1 store a prompt template without sufficient output encoding before rendering in the MCP Admin UI. An authenticated attacker can save markup with script-capable event handlers that execute when another user views the saved prompt. This enables stored XSS, interface alteration, phishing, keystroke observation, and actions in the victim's browser session.

InstallShield version 2025 R2 and earlier has a potential privilege escalation issue when running a compressed Basic MSI setup with Prerequisites from an insecure location. If a local administrator launches Setup.exe with Prerequisites from an unsecured location, the Prerequisite installers may also load from an unsecured location, potentially leading to privilege escalation.

Listed NETGEAR Extender models have insufficient session randomness. A network-adjacent attacker with network access (such as WiFi credentials) can predict valid session identifiers and hijack an authenticated administrator session on the web management portal.

NETGEAR R7300 router has insufficient input validation in the LAN Setup feature. An authenticated administrator connected to the local network can perform unauthorized actions on the router. This was identified in a controlled research environment using a simulated version of the router software and has not been confirmed on physical production devices.

An insufficient input validation vulnerability exists in the PPPoE Setup feature of the NETGEAR R7300 router, allowing authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices.

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages() could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent traversal or an existing symlink below the distribution directory could create new HTML files or directories outside the output tree with the build user's permissions.

SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents.