CVE Vulnerability Catalog

OpenFGA, a high-performance authorization/permission engine, has a vulnerability in BatchCheck calls where multiple checks for the same object, relation, and user combination can result in improper policy enforcement. This affects versions 1.8.0 to 1.13.1.

In itsourcecode sanitize or validate this input 1.0, the file /borrowedequip.php contains an SQL injection vulnerability via the emp_id parameter. An attacker can remotely manipulate this parameter, leading to unauthorized database access.

A vulnerability was detected in Totolink A3300R 17.0.0cu.557_B20221024 allowing OS command injection via the vsetTr069Cfg function in /cgi-bin/cstecgi.cgi. The attack can be launched remotely and the exploit is publicly available.

The Discount library, a C implementation of Markdown, has a signed length truncation bug causing an out-of-bounds read. Inputs larger than INT_MAX are truncated to a signed int before parsing, allowing read past the buffer and process crash. Affects versions from 1.3.1.1 to 2.2.7.3.

Vulnerability in Parse Server before versions 8.6.73 and 9.7.1-alpha.4 allowing file upload with a valid extension but mismatched Content-Type header. Some storage adapters (S3, GCS) serve the file with the provided Content-Type, potentially leading to attacks.

Microsoft's SymCrypt cryptographic library has a truncation bug in the SymCryptXmssSign function, where a 64-bit leaf count is passed to a 32-bit parameter. For XMSS^MT with tree height >= 32, this truncates to zero, causing undersized buffer allocation and heap overflow during signature computation. Affects versions from 103.5.0 to 103.10.0.

dye before 1.1.1 allows arbitrary code execution via crafted template expressions. The vulnerability was discovered and fixed by the author.

WWBN AVideo in versions 26.0 and prior contains a Cross-Site Request Forgery (CSRF) vulnerability in the player skin configuration endpoint at admin/playerUpdate.json.php because it does not validate CSRF tokens. The plugins table is explicitly excluded from the ORM's domain-based security check via ignoreTableSecurityCheck(), removing the only other layer of defense. Combined with SameSite=None cookies, a cross-origin POST can modify the video player appearance on the entire platform.

WWBN AVideo open source video platform versions 26.0 and earlier have a CSRF vulnerability in the site customization endpoint. It lacks CSRF token validation and writes uploaded logo files before ORM security checks, allowing cross-origin POST to overwrite the logo.

WWBN AVideo up to version 26.0 has a vulnerability in the SocialMediaPublisher plugin where the publishInstagram.json.php endpoint acts as an unauthenticated proxy to the Facebook/Instagram Graph API. This allows any unauthenticated user to make arbitrary Graph API calls through the server, potentially using stolen tokens or abusing the platform's own credentials.

Vulnerability in onHeaderDecoded of LocalImageResolver.java leading to persistent denial of service due to resource exhaustion. Local attack requires no additional privileges or user interaction.

In the importWrappedKey function in KMKeymasterApplet.java, there is a vulnerability that allows access to keys that should be restricted due to improper input validation. This could lead to local information disclosure without the need for additional execution privileges. User interaction is not required for exploitation.

In itsourcecode Construction Management System 1.0, the file /borrowed_tool.php contains an SQL injection vulnerability via the emp parameter. An attacker can remotely manipulate this parameter, leading to unauthorized database access.

The Cyber-III Student-Management-System has an XSS vulnerability in the file /admin/class%20schedule/delete_batch.php. Manipulation of the batch argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.

In Vim, the zip.vim plugin before version 9.2.0280 contains a path traversal bypass that allows overwriting arbitrary files when opening specially crafted zip archives. This vulnerability circumvents the previous fix for CVE-2025-53906.

Ajenti before version 2.2.15 allows an authenticated user (using the auth_users plugin) to install a custom package even if not a superuser. This vulnerability is fixed in version 2.2.15.

Chyrp Lite prior to version 2026.01 has an IDOR/Mass Assignment issue in the Post model. Authenticated users with post editing permissions can modify other users' posts by passing internal class properties like id into the post_attributes payload.

An information disclosure vulnerability in AZIOT 1 Node Smart Switch (16A) with firmware version 1.1.9 is caused by improper access control on the UART debug interface. An attacker with physical access can connect to the UART interface and obtain sensitive information from the serial console without authentication.

An authenticated stored XSS vulnerability exists in the creation/editing module of Feehi CMS v2.1.1. Attackers can inject malicious JavaScript or HTML into the Content field, which executes in other users' browsers.

A DoS vulnerability in vLLM from version 0.1.0 to before 0.19.0 allows an unauthenticated attacker to block the asyncio event loop and cause Out-Of-Memory crashes by sending a single HTTP request with an astronomically large n parameter in ChatCompletionRequest and CompletionRequest models.