CVE Vulnerability Catalog

Combodo iTop, a web-based IT service management tool, prior to version 3.2.3 has a sensitive information disclosure vulnerability in error messages. This issue has been fixed in version 3.2.3.

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly privileged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1 and 11.3 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot entry in an imported custom-volume backup. An authenticated user with `can_create_storage_volumes` permission on any project can crash the `incusd` daemon by uploading a backup tarball whose `volume_snapshots[*].expires_at` field is absent. This is a sibling-field variant of GHSA-r7w7-mmxr-47r9 (CVE-2026-40197). Commit `985a1dedf9f3e7ba729c93b654905ed510de25c2` added `if s == nil` at the top of the loop body, but did not guard the adjacent `*snapshot.ExpiresAt` deref 19 lines later. Every other consumer of `Config.VolumeSnapshots[i].ExpiresAt` in this same file already gates the deref with a nil-check — the asymmetric guard is the bug. Version 7.1.0 contains an updated patch.

Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnapshots[i]`, `Volume`, and `Pool` sub-fields. An authenticated user with `can_create_instances` permission on any project can crash the `incusd` daemon by uploading an instance backup tarball whose `dependent_volumes[*]` block contains a nil snapshot pointer (or omits `volume:` / `pool:`). This is a sibling-field variant of the 2026-05-04 batch fix `d768f81c0a1d985f35ae56219519822b080bf5e3` ("Properly check dependent volumes on import"). That commit added `if disk == nil` at the top of the outer loop, but did not guard the four sub-pointer fields the loop body dereferences naked. Version 7.1.0 contains an updated patch.

The Limit Login Attempts Reloaded WordPress plugin before version 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

The Eventin WordPress plugin before version 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows content spoofing and XML injection. Element names, attribute names, and doctype identifiers are interpolated without validation, allowing injection of arbitrary XML markup. Affects versions from 0.0.1 before 2.4.1.

XML Injection vulnerability in joshnuss xml_builder (XmlBuilder module) allows content spoofing and XML injection. The escape/1 function for CDATA data does not handle the ']]>' sequence, allowing premature closure and injection of arbitrary XML. Affects versions from 0.0.7 before 2.4.1.

Inappropriate Encoding for Output Context vulnerability in joshnuss xml_builder (XmlBuilder module) allows content spoofing and cross-site scripting. XmlBuilder.generate/1 does not escape '&' characters when followed by entity-like tokens, allowing injection of XML markup. Affects versions from 0.0.6 before 2.4.1.

Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins have permission to call listHostTags API, but it returns host tags for every host without domain scoping. Affects versions from 4.12.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0.

The Duplicate Post WordPress plugin before 1.5.6 does not check the user's capabilities before returning post data, allowing users with a delegated role to read the content, metadata and passwords of posts they are not allowed to access, including other users' private and draft content.

The Duplicate Post WordPress plugin before 1.5.6 does not check that a user may read the content of a post before duplicating it, allowing users with a delegated role to republish another user's password-protected post as publicly readable.

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.14 does not validate a client-supplied payment amount against the vendor's actual outstanding balance when recording a reverse-withdrawal payment, allowing a vendor to credit their reverse-withdrawal ledger with an arbitrary amount and clear their real commission debt without paying.

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page rendering its upload field.

VOCALOID6 has a missing authentication for a critical function. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts.

OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (SSRF).

TREK before 3.1.0, when the Journey add-on is enabled, interpolates the unescaped activeSuggestion.title value into suggestion text and renders it with dangerouslySetInnerHTML. A trip owner can store HTML in a title, which is executed in a collaborator's session.

SFTPGo from 2.2.0 to 2.7.3, the inline query parameter on file downloads suppresses Content-Disposition: attachment, allowing attacker-controlled HTML files to be served as text/html in the web origin.