CVE Vulnerability Catalog

An XSS vulnerability was found in Roundcube Webmail before versions 1.5.14 and 1.6.14 due to insufficient sanitization of HTML attachments in preview mode. The victim must preview a text/html attachment.

Shynet before 0.14.0 allows XSS in urldisplay and iconify template filters.

Host header injection vulnerability in Shynet before 0.14.0 in the password reset flow.

An XSS vulnerability in cveInterface.js allows injection of HTML that is then displayed, because cveInterface trusts input from CVE API services.

Interzen Consulting S.r.l ZenShare Suite v17.0 contains multiple reflected XSS vulnerabilities in the login.php endpoint. An attacker can execute arbitrary JavaScript in the user's browser context via a crafted URL injected into the codice_azienda and red_url parameters.

Interzen Consulting S.r.l ZenShare Suite v17.0 contains a reflected XSS vulnerability in the login_newpwd.php endpoint. An attacker can execute arbitrary JavaScript in the user's browser context via a crafted URL injected into the codice_azienda parameter.

Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. The token has been removed from the web pages as of 2026-03-27.

Hoppscotch, an open source API development ecosystem, contains a stored XSS vulnerability in the team member overflow tooltip via display name. This issue exists prior to version 2026.3.0.

In hoppscotch before version 2026.3.0, the /enter page contains a DOM-based open redirect vulnerability. The redirect query parameter is directly used to construct a URL and redirect the user without proper validation.

Scoold prior to version 1.66.1 does not enforce authorization when deleting feedback – any logged-in user can delete another user's feedback by providing its ID. Object ownership or moderator privileges are not checked.

NocoBase prior to version 2.0.30 contains a vulnerability in the plugin-workflow-sql plugin, which substitutes template variables directly into raw SQL strings via getParsedValue() without parameterization or escaping. Any user who triggers a workflow containing a SQL node with template variables from user-controlled data can inject arbitrary SQL.

Ella Core, a 5G core for private networks, prior to version 1.8.0 panics when processing a NGAP handover failure message. An attacker can send such messages via gNodeB, causing service disruption for all connected subscribers.

vLLM from version 0.5.5 to before 0.18.0 defaults to using numpy.mean for mono downmixing (to_mono), while the international standard ITU-R BS.775-4 specifies a weighted downmixing algorithm. This causes inconsistency between audio heard by humans and audio processed by AI models (e.g., via vllm, transformer). This issue is fixed in version 0.18.0.

Dataease SQLbot up to version 1.6.0 has a vulnerability in the function get_es_data_by_http in file backend/apps/db/es_engine.py of the Elasticsearch Handler component, allowing manipulation of the address argument leading to server-side request forgery (SSRF). The attack can be performed remotely. A fix is available in version 1.7.0.

XZ Utils before version 5.8.3 has a buffer overflow vulnerability in the lzma_index_decoder() function. Decoding an Index with no Records leads to insufficient memory allocation and a buffer overflow on subsequent lzma_index_append() calls.

In Open edX Platform from the maple release to ulmo, an unauthenticated attacker can fully bypass the email verification process. This exploits OAuth2 tokens issued to inactive users and the exposure of activation_key in the REST API response.

Copier before version 9.14.1 has a vulnerability in the _external_data feature that allows a template to load YAML files from template-controlled paths. A malicious template can read local YAML-parseable files accessible to the user and expose their contents in rendered output.

Copier before version 9.14.1 accepts parent-directory traversal (..) in the _subdirectory setting, allowing a template to escape its own directory and render files from the parent directory without the --UNSAFE flag.

OpenClaw prior to commit 8aceaf5 has a bypass vulnerability in shell-bleed protection, allowing attackers to execute blocked script content using pipes, command substitution, or subshells.

In macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7, an integer overflow was fixed with improved input validation. An app may be able to cause unexpected system termination.