CVE Vulnerability Catalog

A vulnerability in NanaZip (a 7-Zip fork for Windows) prior to version 6.5.1749.0 allows process crashes via a crafted .NET single-file bundle. The issue stems from missing validation of the extraction buffer size against the actual file size, potentially leading to std::bad_alloc or std::length_error exceptions.

In JetBrains YouTrack before version 2026.2.17394, a stored XSS vulnerability was discovered via article titles in digest emails. An attacker can inject malicious JavaScript code into an article title, which will be executed in the recipient's browser when viewing the email.

In JetBrains YouTrack before version 2026.2.17012, a cSS injection vulnerability was discovered via Mermaid diagram rendering. An attacker could exploit this flaw to modify page appearance or potentially steal data.

phpMyFAQ before version 4.1.5 contains a path traversal vulnerability in the concatenatePaths() function in Wrapper.php. An authenticated user with FAQ editing privileges can store crafted HTML with image paths that are processed during PDF generation. Lack of path canonicalization and root-directory containment validation may allow reading files outside the intended content directory.

ImageMagick before version 7.1.2-15 contains a use-after-free vulnerability in the PDB decoder that uses a stale pointer when memory allocation fails. Attackers can trigger this vulnerability by processing malicious PDB files to cause crashes or write a single zero byte to freed memory.

ImageMagick before version 7.1.2-18 contains a memory leak vulnerability in the META reader when processing APP1JPEG input paths. Attackers can trigger this memory leak by providing specially crafted APP1JPEG image files, causing denial of service through resource exhaustion.

A vulnerability in the Elixir Plug library, specifically in the Plug.Conn.Cookies.encode/2 function, fails to neutralize the ';' delimiter in cookie attributes. This allows an attacker to inject additional attributes into the Set-Cookie header, potentially overriding existing cookie attributes.

SQL Injection vulnerability in the postgrex library for Elixir allows an attacker to inject SQL via a LISTEN channel name. The issue occurs during reconnection when channel names are concatenated in an anonymous code block, and the quote_channel/1 function does not escape the $$ delimiter, causing the notification connection to break and resulting in denial of service.

A flaw was found in libarchive that allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to denial of service or potentially arbitrary code execution.

A path traversal vulnerability was found in halo-dev halo up to version 2.24.2 in the ThemeUtils.unzipThemeTo function of ThemeUtils.java during theme installation. Manipulating the metadata.name argument allows remote exploitation, and a public exploit is available.

In MyEMS up to version 6.4.0, the on_post function in the file myems-api/core/svg.py of the Admin Backend component is vulnerable to XSS via the new_values['data'] argument. The attack can be launched remotely and the exploit has been made public.

A Cross-Site Scripting (XSS) vulnerability was found in the Matrix Adapter component of NousResearch hermes-agent up to version 2026.5.29.2, specifically in the MatrixAdapter._markdown_to_html function of gateway/platforms/matrix.py. The attack can be executed remotely and the exploit is publicly available.

A flaw in the Symphonia library up to version 0.6.0 in the Metadata Handler component allows a local denial of service (DoS) attack. An exploit has been published, and a fix is pending acceptance.

A vulnerability was found in the fbxcel library up to version 0.9.0 in the Node Header Handler component. Manipulation of data in the parser.rs file leads to a denial of service (DoS). The attack requires local access and the exploit is publicly available.

In Open WebUI from version 0.6.16 before 0.10.0, the Socket.IO server is configured with always_connect=True, and the ydoc:awareness:update and ydoc:document:leave handlers accept collaborative-document events without requiring an authenticated user, allowing unauthorized manipulation of document collaboration state.

A vulnerability in Open WebUI versions from 0.9.0 before 0.10.0 allows deactivated users to continue scheduled model execution. The execute_automation function rehydrated automation owners without rechecking their activity status, and check_model_access only enforced private-model grants for the exact user role.

In Open WebUI prior to version 0.10.0, a vulnerability exists where channel thread parent and reply handling did not bind parent_id to the channel in the URL. This allows an authenticated user to reference a message from another private or DM channel and disclose thread context across channels.

In Open WebUI versions from 0.6.27 before 0.10.0, the get_all_models handlers in routers/openai.py and routers/ollama.py passed a lambda to the aiocache key instead of key_builder, causing permission-filtered per-user model lists to share a static cache entry. This exposes one user's model list to another caller during the TTL window.

A use-after-free vulnerability has been discovered in Open5GS 2.7.7 in the AMF component, specifically in the amf_context_final function in src/amf/context.c. The attack requires local access and the exploit has been publicly released, enabling potential attacks.

A vulnerability was found in GPAC 26.03-DEV in the vobsub_read_idx function of the MP4Box component. Manipulating the num_langs argument can cause an out-of-bounds read. The attack requires local access and the exploit has been publicly disclosed.