CVE Vulnerability Catalog

Cloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader) without requiring the Admin.Write OAuth scope, unlike the node create/update/delete routes. An OAuth client authorized with only Admin.Read can submit attacker-controlled node definitions and cause the server to issue outbound requests to arbitrary URLs, enabling blind SSRF, internal service probing, and delivery of signed slave-style requests.

Fleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the intended random, time-limited URL token. Because Apple's InstallEnterpriseApplication MDM command requires these URLs to be reachable without a Fleet session, they cannot rely on session-based authentication, and the missing token allows an unauthenticated attacker with network access to the Fleet server to download in-house IPA binaries and their metadata by guessing sequential title identifiers. The impact is limited to read-only disclosure; there is no privilege escalation or write access, and the free tier is unaffected.

Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or secret_token is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execute actions on attacker-supplied input.

Heym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote unauthenticated attackers can send forged Slack events to known webhook URLs to trigger workflows with the owner's credentials.

Parse Server versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91 do not verify the client's authorization code with the external provider on the login endpoint when authentication data is supplied with a username and password. This allows a low-privileged authenticated user to attach an arbitrary, unverified provider identity to their own account, and also enables account pre-hijacking. Fixed in versions 9.10.1-alpha.10 and 8.6.91.

The account recovery (password reset) functionality in the vulnerability-lookup web application contains a TOCTOU race condition in the consumption of single-use recovery tokens. Two concurrent HTTP requests with the same valid token can both pass verification before either transaction commits, allowing both to set their own password on the target account. Additionally, a secondary defect in the same endpoint allows a valid recovery link to set an empty or trivially short password because form validation is not invoked.

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated.

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted.

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name.

A vulnerability in wolfSSL causes CRL checking to be skipped for certificates without an OCSP URL when both OCSP and CRL revocation checking are enabled. As a result, a certificate revoked by CRL may be accepted, and a missing OCSP responder is treated as a positive response. The issue affects versions up to 5.9.2 and is reachable over TLS 1.0-1.3 and DTLS.

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in all type-blind sibling consumers. Affects wolfSSL versions 5.8.4 through 5.9.2 with specific macros or --enable-opensslextra, when the application calls X509_verify_cert.

wolfSSL versions 5.9.2 and earlier fail to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepts certificates for hostnames they shouldn't cover due to a chain-walking state-machine bug.

In wolfSSL versions 5.7.2 through 5.9.2, a client-side implementation flaw in RFC 6961 (multiple OCSP response stapling) can lead to certificate forgery. When a client enables OCSP stapling with HAVE_CERTIFICATE_STATUS_REQUEST_V2 and calls wolfSSL_UseOCSPStaplingV2, it accepts any certificate in the peer's chain as a CA without verifying authorization.

In all builds using (D)TLS, including default builds, there is a series of conditional states during TLS shutdown that could lead to a heap-use-after-free. If an application gets a partial wolfSSL_read() result, sometimes caused by a small user buffer, then calls wolfSSL_shutdown for a bidirectional close and attempts wolfSSL_read() again while the peer continues sending data during shutdown, it could lead to a heap-use-after-free.

In wolfSSL versions v5.3.0 through v5.9.2, when NO_SESSION_CACHE_REF is undefined, wolfSSL_get_session() returns a handle into the process-global SessionCache instead of a session object. Because the TLS 1.2 session ID is server-chosen and sent in clear, a malicious server can overwrite the client's cache entry for another server and then be accepted as the original server during session resumption without certificate or domain name verification.

The PowerPress Podcasting plugin by Blubrry for WordPress before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the plugin's configuration.