CVE Vulnerability Catalog

UI misrepresentation in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML page.

The RabbitMQ Java client library prior to 5.35.0 includes the raw URI value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, broker credentials can be disclosed through startup logs, monitoring systems, CI logs, and copied stack traces.

The RabbitMQ Java client library prior to 5.37.0 has a flaw in com.rabbitmq.tools.json.JSONReader.read() that fails to terminate when input ends inside a quoted string or line comment. The default DefaultJsonRpcMapper can then exhaust the heap or consume CPU indefinitely, resulting in denial of service.

LiquidJS prior to 10.27.2 does not consistently enforce ownPropertyOnly for inherited array indices, as negative indexing, .first, .last, first/last filters, join, reverse, slice, compact, and for-loop iteration can read prototype-provided elements outside readJSProperty(). An attacker able to influence prototype state can disclose values that ownPropertyOnly is expected to hide.

LangChain prior to 1.3.1 does not enforce the documented string type for an untrusted structured session identifier at runtime, allowing it to be interpreted as a MongoDB query condition rather than a literal value. An attacker able to invoke chat-history operations can read, modify, or delete another user's stored conversation when histories are stored in a shared MongoDB collection.

A DOM-based XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling in the redirect route. The application extracts a target from the next query parameter and assigns it directly to location.href, bypassing built-in URL validation and allowing arbitrary JavaScript execution in an authenticated user's session.

An authentication bypass in the OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.

TP-Link Tapo C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ SOAP handlers. An authenticated ONVIF client can submit an excessive number of preset-related elements, causing writes beyond fixed-size stack arrays and crashing the service.

Dell Command | Configure (DCC) versions prior to 5.2.3.35 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to information disclosure.

A missing authorization vulnerability in GitHub Enterprise Server allowed a repository collaborator with write access to delete the current default branch via the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories requiring pull-request review but not restricting branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content.

In the is_pd_allowed function in gem_msg.c, there is a missing permission check, allowing a permission bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop, leading to high CPU utilization and service stalls.

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. This issue affects multiple WordPress versions from 6.6 through 7.1.2.

In ImageSharp from 2.0.0 to 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ReadValue64 returns without advancing the stream or terminating the loop, allowing a small malformed BigTIFF to keep a decoder thread executing for an attacker-controlled duration. Fixed in 4.1.2.

In ImageSharp from 1.0.0-beta0001 to 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared dimensions before confirming the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier parsing paths can allocate large jagged representations from a short truncated profile. In version 4, automatic conversion reaches the parser when ColorProfileHandling is Convert; default Preserve avoids that path. Fixed in 4.1.2.

In ImageSharp from 4.0.0 to 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result shorter than the required EXR block size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes from a completed prior ImageSharp operation to appear in decoded pixels. Applications exposing pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. Fixed in 4.1.2.

In Quasar Framework from 1.0.0 to 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation or a mistaken configuration. Fixed in 3.3.0.

Bludit CMS 3.22.0 has an issue that allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints.

JetBrains TeamCity before 2026.2.1 contains a vulnerability due to missing validation of Git submodule URLs, allowing reading local repositories on the server. Attackers can exploit this to access confidential data.

SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in an unknown function of the file /opils/admin/view_product.php. Manipulation of the Category argument allows remote attack. The exploit is public.