CVE Vulnerability Catalog

An unauthenticated reflected XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to sanitize the 'portal' parameter in invalid_browser and invalid_browser_login handlers, allowing attacker-controlled script execution in a victim's browser.

Open Event Server up to version 1.19.1 has a missing authentication vulnerability in the group followers CSV export endpoint, allowing unauthenticated attackers to export the complete member roster of any group, including email addresses, names, join dates, and roles. Attackers can brute-force sequential group IDs, trigger an export via the unauthenticated POST endpoint, and poll the unauthenticated task status endpoint until completion to obtain a download URL with the full member CSV.

ForgeCode automatically loads and executes MCP servers defined in a repository's .mcp.json file without user confirmation. A malicious repository can supply a crafted .mcp.json that runs arbitrary commands (e.g., bash -c 'touch /tmp/pwned') with the user's privileges. This leads to arbitrary code execution when working with untrusted repositories.

A vulnerability in Symfony UX allows an attacker to swap a signed data blob between components or slots, enabling the setting of read-only properties on a target component. Affected versions are from 2.8.0 to 2.36.0 and 3.1.0.

A vulnerability in Symfony UX allows unauthenticated users to turn the public autocomplete endpoint into a broad matcher or blind boolean oracle. The issue is due to missing escaping of SQL LIKE wildcards (% , _ , \) in the client-supplied query.

Missing authentication for a critical function in Vimesoft Enterprise Video Platform allows authentication bypass. The vulnerability affects versions from 3.11.0.0 before 3.25.0.

The Joomla extension Events Booking prior to version 5.8.0 has a file upload endpoint lacking CSRF protection, allowing user enumeration.

Stored XSS vulnerability in ChronoForms extension for Joomla versions 8.0 to 8.0.52 allows an unauthenticated attacker to inject persistent scripts.

A path traversal vulnerability was found in GitHub Enterprise Server within the Dependabot updater container. An attacker with code execution in that container could write files to arbitrary repository paths, including GitHub Actions workflow files, potentially leading to secret theft.

A Broken Object Level Authorization (BOLA) vulnerability in osTicket versions 1.18.3 and 1.17.7 leads to Insecure Direct Object Reference (IDOR) in the AJAX ticket-management subsystem. An attacker can gain unauthorized access to other users' tickets.

A vulnerability in HTTP::Date for Perl before version 6.08 causes CPU exhaustion via polynomial regex backtracking in the parse_date function. An attacker can send a crafted date header that forces quadratic computational complexity, leading to prolonged CPU consumption.

Missing Authorization in Google Cloud Firebase Studio prior to April 15, 2026 allowed an attacker to download other users' deployed source code and access sensitive data via unauthorized GCS URL signing requests. The vulnerability was patched on April 15, 2026, and no customer action is needed.

An open redirect vulnerability in SigNoz before 0.134.0 in the SSO authentication flow. An unauthenticated attacker can steal session tokens from users on instances configured with Google OAuth, SAML, or OIDC.

A binary planting vulnerability in Cursor for Windows version 3.2.16 allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe in the repository root. When a developer clones and opens a crafted repository, Cursor automatically executes the malicious binary without user interaction.

A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x and 8.x allows an attacker with privileges to call vncproxy to hijack a VNC session established in parallel by a different user for a different VM.

A vulnerability in SEPPmail Secure Email Gateway and SEPPmail Cloud before version 15.0.4.2 allows an attacker to replay and hijack a user session in the GINA web portal. The session token is disclosed inside the URL and an HTTP header.

A vulnerability in IKAS Technology Inc. E-Commerce software allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. This issue affects versions up to and including 03062026.

A server-side request forgery (SSRF) vulnerability was found in poco-ai poco-claw up to version 0.5.4. The issue affects the run_task function in the executor/app/api/v1/task.py file, where the callback_url argument can be manipulated by an attacker. The attack can be carried out remotely, and the exploit is publicly available.

A NoSQL injection vulnerability was discovered in AhnLab EPP Management version 1.0.14.32-6249 via the eventlog/agentEvent/list endpoint. An attacker can exploit this flaw to manipulate NoSQL database queries.

A vulnerability has been found in NetCAD Software Inc.'s NetGIS product, caused by improper restriction of XML external entity references (XXE). This flaw allows serialized data external linking, potentially leading to disclosure of sensitive information.