CVE Vulnerability Catalog

In the Balbooa Forms extension for Joomla (versions below 2.4.3.4), the public removeTmpAttachment action accepts an attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind the attachment ID to the session that uploaded the file, the current user, the form, or the temporary state, allowing any guest to perform unauthorized deletion of attachments.

Stored XSS vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows persistent script injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Stored XSS vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows persistent script injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Stored XSS vulnerability in the Flow extension for MediaWiki due to improper input neutralization during web page generation. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

In urllib3 (versions 2.6.2 through 2.8.0), the HTTPResponse.stream and HTTPResponse.read_chunked methods can enter an infinite loop because the Deflate decoder retains trailing bytes as unconsumed input after reaching end-of-stream and repeatedly decodes them without progress. The issue occurs when an untrusted server sends a chunked Deflate response whose decoded body exceeds a positive finite chunk size and whose encoded body has trailing bytes.

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.

In Devolutions Server 2026.3.5, improper rule enforcement in the PAM Active Directory provider allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

An established DTLS 1.2 association using an AEAD cipher suite can be terminated by a single unauthenticated datagram whose encrypted fragment is shorter than the mandatory explicit IV and authentication tag overhead. The record layer passes the record length to the cipher before checking it is long enough, causing an internal error instead of treating the record as failed authentication.

A NULL pointer dereference vulnerability in the OpenSSL CMP client. When a client requests certificate revocation based on a PKCS#10 CSR and the server returns a specially crafted certificate name in its response, the client reads from a NULL pointer and crashes. Only clients that identify the certificate via CSR (e.g. 'openssl cmp -cmd rr -csr' or OSSL_CMP_exec_RR_ses() with OSSL_CMP_CTX_set1_p10CSR()) are affected.

The OpenSSL QUIC stack does not enforce connection-level flow control for streams. A malicious remote peer can send more bytes as long as they fit within stream flow control limits, leading to excessive memory allocation.

The QUIC stream reassembly algorithm in OpenSSL degrades progressively as packets arrive out of order, with worst-case quadratic complexity. A remote QUIC peer that completes the handshake can cause CPU pressure and potential DoS with low bandwidth.

A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possible Denial of Service.

UnoPim versions before 2.0.1 and 2.1.1 trust all connecting clients as proxies and honor the X-Forwarded-Host header without validation, allowing unauthenticated attackers to inject arbitrary origins into admin layout pages. Attackers can set X-Forwarded-Host to redirect JavaScript asset loading to their server, and when responses are cached by shared proxies, subsequent administrators execute attacker-supplied code in their authenticated sessions.

In Werkzeug before 3.1.9, the safe_join function used by send_from_directory can allow a NUL: special-device path because safe_join checks the Windows device name without first removing an empty NTFS ADS marker. The trigger is an application running on Windows with NTFS serving a user-specified path ending in a special device name such as NUL:.

In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the gateway network scan token API allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.

In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the attachment history API allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.

In Devolutions Server 2026.3.5.0 and earlier, missing authorization in the data source settings API allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.

Access to the service menu is obfuscated but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password.

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescaped into the WHERE clause of an UPDATE statement. An authenticated administrator with basic_settings permission can inject arbitrary SQL payloads to extract or modify database contents.

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPDATE statement without proper escaping. An authenticated administrator with video_moderation permission can inject arbitrary SQL commands to extract or modify database contents.