CVE Vulnerability Catalog

Stored XSS vulnerability in the Refreshed skin of MediaWiki due to improper input neutralization during web page generation. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds. An attacker with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on devices without Android Verified Boot protection.

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() when allocating the directory table buffer. An attacker can supply a crafted SquashFS image with an attacker-controlled superblock metablks_count value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. An attacker can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. The function MailController::templatePut in cmf-api/src/admin/controller/MailController.php of the Email Template component is affected. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be carried out remotely, and the exploit has been publicly disclosed.

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

virtualenv is a tool for creating isolated virtual Python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata.

JupyterLab is an extensible environment for interactive and reproducible computing. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installation but passes uninstall names to PyPIExtensionManager.uninstall and python -m pip uninstall without rejecting option-like values. An authenticated user with extension API access can supply a pip requirements option to make the server read a local file or fetch an internal URL, and reflected parse errors can return the first unparsable line or response content.

OS Command Injection vulnerability in VoiceMode up to 8.10.1. The update_config MCP tool and 'voicemode config set' CLI write caller-supplied values to ~/.voicemode/voicemode.env without shell-safe escaping.

Directory Traversal vulnerability in mcp-filesystem-server v0.11.1 due to improper link resolution in validatePath. When EvalSymlinks returns os.IsNotExist for a dangling symlink, the fallback validates only the parent directory and returns the unresolved path, allowing file writes outside allowed directories.

Improper Access Control in ArgusMonitor.sys in Argotronic ArgusMonitor 7.4.02 and earlier allows local low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRP_MJ_CREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service.

KitchenAsty through 0.3.0 contains an IDOR vulnerability in the reservations API. The endpoint GET /api/reservations/:id applies authentication middleware but lacks ownership or role checks, and the getReservation handler returns the record by client-supplied identifier without comparing reservation.customerId to the authenticated principal.

A sensitive information disclosure vulnerability exists in the underlying OS of HPE Networking Instant On. Successful exploitation by an authenticated local attacker with high privileges could retrieve information useful for further access to network services, but only if certain preconditions outside attacker's control are met.

A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could interrupt normal operation and access limited information within the component.

A denial-of-service vulnerability in the API endpoint of HPE Networking Instant On could allow an authenticated attacker with administrative privileges to cause a denial of service. The service resumes without manual intervention.

A local privilege-escalation vulnerability in the affected daemon of HPE Networking Instant On could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met.

An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow limited data access and limited changes.

An authentication bypass vulnerability in the PAPI protocol of HPE Networking Instant On APs could allow an unauthenticated adjacent attacker to circumvent authentication controls. Successful exploitation could allow sending unauthorized network traffic to the target device.

A format string vulnerability in the API endpoint of HPE Networking Instant On APs could allow an authenticated remote attacker with high privileges to cause memory corruption with modified input. Successful exploitation could lead to DoS or remote code execution.