CVE Vulnerability Catalog

In Open edX Platform from the maple release to ulmo, an unauthenticated attacker can fully bypass the email verification process. This exploits OAuth2 tokens issued to inactive users and the exposure of activation_key in the REST API response.

Copier before version 9.14.1 has a vulnerability in the _external_data feature that allows a template to load YAML files from template-controlled paths. A malicious template can read local YAML-parseable files accessible to the user and expose their contents in rendered output.

Copier before version 9.14.1 accepts parent-directory traversal (..) in the _subdirectory setting, allowing a template to escape its own directory and render files from the parent directory without the --UNSAFE flag.

OpenClaw prior to commit 8aceaf5 has a bypass vulnerability in shell-bleed protection, allowing attackers to execute blocked script content using pipes, command substitution, or subshells.

In macOS Sequoia 15.6, macOS Sonoma 14.7.7, and macOS Ventura 13.7.7, an integer overflow was fixed with improved input validation. An app may be able to cause unexpected system termination.

An out-of-bounds access issue was fixed with improved bounds checking. Affected are iOS 18.6, iPadOS 18.6, iPadOS 17.7.9, macOS Sequoia 15.6, macOS Sonoma 14.7.7, macOS Ventura 13.7.7, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing a malicious media file may lead to unexpected app termination or memory corruption.

A vulnerability was found in Newgen OmniDocs up to version 12.0.00 in the file /omnidocs/WebApiRequestRedirection. Manipulation of the DocumentId argument leads to improper control of resource identifiers, enabling remote attack. The exploit is publicly available.

OpenSSH before version 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

Rack::Request incorrectly parses the Host header, accepting characters like /, ?, #, and @ that are not allowed in RFC-compliant hostnames. The req.host method returns the full unvalidated value, allowing bypass of host validation based on simple prefix or suffix checks.

In ewe (Gleam web server) prior to version 3.0.6, the encode_headers function in src/ewe/internal/encoder.gleam directly interpolates response header keys and values into raw HTTP bytes without validating or stripping CRLF (\r\n) sequences. An application that passes user-controlled data into response headers (e.g., setting a Location redirect header from a request parameter) allows an attacker to inject arbitrary HTTP response content, leading to response splitting, cache poisoning, and possible cross-site scripting.

Vulnerability in the leancrypto cryptographic library (versions before 1.7.1). The lc_x509_extract_name_segment() function casts size_t vlen to uint8_t when storing the Common Name (CN) length, potentially leading to overflow and identity impersonation.

NanoMQ before version 0.24.10 has an out-of-bounds read vulnerability in the hook_work_cb() function in webhook_inproc.c. The cJSON_Parse function reads data from a buffer without a guaranteed null terminator, potentially accessing memory beyond the allocated buffer.

Frappe LMS is vulnerable to stored Cross-Site Scripting (XSS). The vulnerability affects versions from 2.27.0 to before 2.48.0.

In YesWiki prior to version 4.6.0, a stored and blind XSS vulnerability was found in the form title field. An unauthenticated attacker can inject JavaScript that executes when other users visit the page.

Poetry, a dependency manager for Python, from version 1.4.0 to before 2.3.3 allows arbitrary file write via a crafted wheel containing ../ paths. The attack is reachable during normal package install flows.

Postiz prior to version 2.21.4 has a blind SSRF vulnerability in the POST /webhooks/ endpoint. URL validation does not block internal/private addresses, allowing attackers to make requests to internal services.

listmonk versions 4.1.0 to before 6.1.0 have bugs in list permission checks that allow users in a multi-user environment to access lists they don't have permission to. This only affects multi-user environments with untrusted users.

In SillyTavern prior to version 1.17.0, an SSRF vulnerability was found in the search.js function. Hostname validation only covers dotted-quad IPv4, allowing bypass via localhost, IPv6, and DNS names resolving to internal addresses. A port check limits exploitation to default ports, reducing risk.

SillyTavern before version 1.17.0 has a path traversal vulnerability in static file handling. An unauthenticated attacker can check for the existence of arbitrary files on the server by sending percent-encoded "../" sequences.

TP-Link Tapo C520WS v2.6 has a DoS vulnerability in HTTP request path parsing. Failure to account for path expansion during normalization leads to buffer overflow and memory corruption, potentially causing device reboot.