CVE Vulnerability Catalog

Drupal core versions 8.0.0 to 10.5.9, 10.6.0 to 10.6.7, 11.0.0 to 11.2.11, and 11.3.0 to 11.3.7 are vulnerable to Cross-Site Scripting (XSS) due to improper input neutralization during page generation.

Cross-site scripting vulnerability in Drupal Orejime before version 2.0.16. Improper input neutralization during page generation allows injection of malicious scripts.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier allow a user to list and download their own attachments from an issue created by another user even after it becomes private, bypassing read access revocation. The confidentiality impact is minimal as only the user's own attachments are accessible. This is fixed in version 2.82.2.

Joplin versions 3.5.2 and earlier contain a logic error in the delta API that allows share recipients to download notes that are no longer shared with them. The flaw stems from improper filtering of item state and change compression, leading to data leakage.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and earlier are vulnerable to authorization bypass via the private issue monitoring feature. A user with project-level access can add themselves as a monitor for a private issue they cannot access by sending a crafted POST request to bug_monitor_add.php. Despite an Access Denied error, the monitor relationship is created, leading to email notifications that disclose private issue metadata and content. This is fixed in version 2.28.2.

A vulnerability in Template::Plugin::HTML for Perl through version 3.102 allows HTML and JavaScript injection. The html_filter function does not properly escape single quotes, allowing code injection in HTML attributes enclosed in single quotes.

In Mantis Bug Tracker (MantisBT) versions 2.28.1 and prior, a privilege escalation vulnerability exists. Users with manage_project_threshold access level (manager by default) can grant project-level administrator access to any user in any project they manage. The issue has been fixed in version 2.28.2.

CtrlPanel (open-source billing software for hosting providers) versions 1.1.1 and prior contain a stored XSS vulnerability in the admin role management interface. The datatable() method in RoleController.php interpolates role name and color directly into HTML without sanitization, and .rawColumns(['actions', 'name']) disables automatic escaping. An admin with role creation or edit permissions can inject malicious code that executes on every load of the /admin/roles page by any admin.

Ledger Nano X, Flex, and Stax devices contain a denial of service vulnerability in the MCU firmware update process due to missing validation of the reset_handler parameter during flashing. An attacker can provide a crafted reset_handler address pointing to invalid memory or attacker-controlled code, causing an unrecoverable fault state during boot and permanent loss of operability.

Improper input validation in SMM communications buffer could allow a privileged attacker to perform out-of-bounds read/write in TSEG memory, potentially compromising confidentiality or integrity.

Ledger Live with vulnerable versions of ledgerhq/hw-app-eth prior to 6.34.7 contains an integer parsing vulnerability that allows attackers to manipulate EIP-712 typed data messages by exploiting incorrect hexadecimal field parsing when values contain an odd number of characters. Attackers can obtain signatures on truncated or misinterpreted message values to authorize unintended blockchain transactions.

CtrlPanel open-source billing software for hosting providers, versions 1.1.1 and prior, exposes multiple admin DataTable endpoints without authorization checks, allowing any authenticated user to access sensitive administrative data.

CtrlPanel versions up to 1.1.1 contain a remote code execution (RCE) vulnerability in the admin settings update endpoint. The vulnerability is due to missing validation of the loaded class, allowing an authenticated admin to dynamically call any class available in the Composer autoloader, potentially leading to code execution.

In libheif before version 1.22.0, when decoding a HEIF grid image with strict_decoding=false, a corrupted tile silently fails and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The Y, Cb, and Cr planes are not zeroed, so heap data appears in pixel values.

Joplin, an open-source note-taking and to-do application, versions 3.6.14 and prior, contains a Denial of Service (DoS) vulnerability in the note title input due to missing length validation. An attacker can cause an Out Of Memory (OOM) error and program termination by inserting an excessively long string into a note's title, either via the UI or through the local web service API (port 41184) after compromising an authentication token. The issue is fixed in version 3.7.1.

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a conn_id containing a '/' (e.g. 'my_team/conn') to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could retrieve another team's secret by crafting a colliding conn_id. Fixed in 9.28.0 by switching the team-scope separator to '--' and rejecting team-shaped conn_ids when team context is absent. Affects the experimental multi-tenant teams feature only.

libheif versions 1.21.2 and below are vulnerable to a DoS attack via an infinite loop in Box_stts::get_sample_duration(). A crafted 800-byte HEIF file causes 100% CPU usage with no progress, leading to denial of service. The issue occurs during file opening, before any user interaction.

Authorization bypass vulnerability in the Kirki plugin for WordPress up to version 6.0.6. Allows authenticated attackers with subscriber-level access or higher to view all Kirki frontend forms and read stored visitor submission data, including contact details and messages.

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

Discourse prior to versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 contains a vulnerability in the discourse-subscriptions plugin that allows users to gain access to subscription-gated groups without completing payment.