CVE Vulnerability Catalog

A vulnerability in Johnson Controls Illustra Standard - L4L China on Windows involves improper input validation, allowing OS command injection. This issue affects versions before 6.0.0.66394.

Reflected XSS vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack due to improper input neutralization during web page generation. Affects versions through 2026-10-06.

Mooncake Store through 0.3.13.post1 has a missing authorization vulnerability allowing unauthenticated attackers to inject completed LOCAL_DISK replicas via NotifyOffloadSuccess RPC. Attackers can mount a local disk segment with a self-chosen client UUID, then attach replicas pointing at attacker-controlled endpoints to serve poisoned disk-tier reads and fake key existence.

Mooncake Store through 0.3.13.post1 has a missing authorization vulnerability allowing unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopyTask, CreateMoveTask, FetchTasks, and MarkTaskToComplete with victim client UUIDs disclosed by QueryTask to hijack task queues and record replication that never occurred.

lrzsz before 0.13.0 has a heap-based buffer overflow in procheader() of the lrz receive utility when copying overlong sender-supplied filenames into Pathname. Malicious ZMODEM senders can supply filenames up to 8192 bytes, overflowing the buffer via sprintf() in pipe mode or strcpy() to corrupt heap memory and crash lrz.

libmikmod before 3.3.14 has a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to read adjacent heap memory via oversized patterns. Attackers can supply a crafted IT module with more than 200 pattern rows, causing IT_ConvertTrack() to read past the itpat buffer and crash applications.

Microsoft UFO prior to 3.0.9 has a vulnerability where authenticated device registration through /api/devices can supply a permitted attacker-controlled WebSocket endpoint while aip/transport/websocket.py applies pinned_addresses only to the initial destination. The pinned websockets.connect() client follows cross-origin redirects and opens a new TCP connection before Galaxy performs its post-handshake peer-IP validation, allowing WebSocket upgrade requests to internal hosts reachable from the server. The confirmed impact is the internal connection and handshake request, and does not establish arbitrary HTTP methods, response-body disclosure, a completed AIP session, or cloud metadata access. This issue is fixed in version 3.0.9.

In Microsoft UFO's execute_command tool (linux_mcp_server.py), sort and uniq are treated as read-only commands even though their options allow file output. An authenticated caller can use sort -o or the optional second uniq operand to create or overwrite files writable by the UFO server process without shell metacharacters. The issue is fixed in version 3.0.9.

A Cross-site Scripting (XSS) vulnerability exists in the Forums feature of OpenText Content Management Content Server. A bad actor could inject malicious code into a Forums web page.

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms. Hotel-restricted back-office employees can modify rooms of other hotels by submitting foreign room IDs in the id_rooms parameter, changing status, floor, comments, or inactive dates.

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the apiSourceGetContent endpoint to obtain database passwords, LDAP bind credentials, and other projects' data.

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. Affected versions include 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 (and later).

The vulnerability allows an unauthenticated attacker to bypass the login lockdown mechanism in versions up to and including 2.17.

The vulnerability in cloak_ecto and cloak libraries involves using a password hash with insufficient computational effort. An attacker who holds hashed values and the configured secret can brute-force low-entropy plaintexts much faster than configured.

The vulnerability allows an unauthenticated attacker to change settings in the PayPlug for WooCommerce (Official) plugin in versions up to and including 3.1.0.

The vulnerability allows an unauthenticated attacker to change settings in the TrueBooker plugin in versions up to and including 1.2.9.

The vulnerability allows an unauthenticated attacker to access sensitive data in the Mailjet Email Marketing plugin in versions up to and including 6.2.3.

The vulnerability allows a subscriber-level user to perform a Cross Site Scripting (XSS) attack in the Front End PM plugin in versions up to and including 11.4.6.

The vulnerability allows an unauthenticated attacker to exploit Broken Access Control in the 10Web Social Photo Feed plugin in versions up to and including 1.4.35.

The vulnerability allows an unauthenticated attacker to bypass the Captcha mechanism in the Captcha by BestWebSoft plugin in versions up to and including 5.2.8.