CVE Vulnerability Catalog

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user-supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user-supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.

In NTFS-3G before 2026.7.7, an out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information from ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.

In wger prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slot_entry ID in a POST /api/v2/workoutlog/ request. The slot_entry foreign key is not included in ownership verification, and the injected data is silently folded into the victim's progressive-overload calculations, corrupting auto-generated targets.

In wger prior to version 2.6, a vulnerability in the authentication/session lifecycle allows bearer-style API credentials to remain valid after a user logs out and after a password change. An attacker who steals a DRF authtoken or JWT refresh token can continue to access protected /api/v2/* endpoints until the token is manually rotated/deleted or naturally expires.

In wger prior to version 2.6, the trainer_login view accepts GET requests and executes django_login() without CSRF protection, because Django's CsrfViewMiddleware only enforces tokens on unsafe methods. An attacker can embed an <img> tag on a malicious page; when an authenticated trainer loads it, their browser auto-issues the GET with the session cookie, forcibly rebinding the trainer's session to an arbitrary user account.

A post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC). Under specific conditions, a remote authenticated attacker with administrator privileges could store and potentially execute arbitrary JavaScript code in the AMC.

A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version dev, commit 38b21f78). A specially crafted .eml file can lead to arbitrary file write, which an attacker can trigger by providing a malicious file.

A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (dev version, commit 38b21f78). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability.

Express Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored OAuth 2.0 token secrets via the default crypto.cipherKey 'sensitiveKey'. Attackers who can read Redis can decrypt tokenEncrypted values and combine them with stored token IDs to obtain valid bearer tokens for any user.

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharing_group_id, the internal before-save hook stored the incoming (new) data rather than the previously persisted values. As a result, the after-save comparison that determines whether a correlation refresh is needed never detected the change, and stale correlations persisted. Security impact: stale correlations may continue to expose event data to users in a broader sharing group after the event has been moved to a more restrictive group, resulting in unintended information disclosure. Conversely, newly relevant correlations may not appear after a distribution widening, degrading the completeness of threat intelligence sharing. Preconditions: an authenticated user with write access to at least one MISP event; the user modifies the event's distribution or sharing_group_id field. Affected versions: <2.5.48

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected application.

Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token secret or issuing client. Attackers with any valid client credentials and the identifier portion of another user's refresh token can obtain that user's access token and impersonate them against oauth2-protected APIs.

Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result.

Obot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just revoked in the identity provider. When overlapping refreshes for the same user commit out of order, stale memberships are persisted and the user retains revoked group-based access for about ten minutes.

Obot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts and resources of ungranted components. Because profiles were enforced only on tools, attackers can access prompts, resources, and resource templates through the vMCP owner's shared component connection.

Obot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set on MCP catalog entries by admins or power users. Basic users granted an entry by access control rules can request GET /api/all-mcps/entries/{entry_id} to obtain plaintext API keys or tokens and abuse them against backend services.

MiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network attackers to crash the daemon. Attackers can send a single multicast M-SEARCH datagram with MX: 0 and a known ST to port 1900, triggering SIGFPE and denying UPnP IGD service.

Stored XSS vulnerability in the Media Library Assistant plugin by David Lingren. Improper input neutralization during page generation allows persistent execution of malicious scripts in the victim's browser.