CVE Vulnerability Catalog

Search Guard FLX versions 3.0.0 through 4.0.1 allow users without the necessary privileges to execute management operations on data streams.

In Parse Server before versions 8.6.70 and 9.7.0-alpha.18, an authenticated user with find class-level permission can bypass the protectedFields setting on LiveQuery subscriptions. By sending a subscription with $or, $and, or $nor as an array-like object, the protection is bypassed, allowing reading of protected fields.

Parse Server before versions 8.6.69 and 9.7.0-alpha.14 allows an authenticated user to bypass the immutability guard on session fields (expiresAt, createdWith) by sending a null value in a PUT request to the session update endpoint. This allows nullifying the session expiry, making the session valid indefinitely and bypassing configured session length policies.

MCP Java SDK before versions 0.83.0, 1.0.1, and 1.1.1 has a hardcoded wildcard CORS vulnerability, allowing access from any origin.

In the Slippers Django package, the {% attrs %} template tag does not escape output, leading to XSS. An attacker can inject arbitrary HTML or JavaScript via a context variable.

In libp2p-rust before version 0.49.4, the Gossipsub implementation contains a remotely reachable panic in backoff expiry handling. After receiving a crafted PRUNE message with a near-maximum backoff value, the implementation performs unchecked time arithmetic, leading to overflow and panic.

ClearanceKit has a startup defect where only compile-time rules are enforced until user interacts with GUI. MDM and user-defined rules are not applied.

An incorrect startup configuration of Zscaler Client Connector on Windows may cause a limited amount of traffic to bypass inspection under rare circumstances.

Search Guard FLX up to version 4.0.1 allows redirecting users to an untrusted URL via specially crafted requests.

Parse Server before versions 8.6.65 and 9.7.0-alpha.9 has a LiveQuery vulnerability. When multiple clients subscribe to the same class, shared mutable objects modified by sensitive data filters can leak protected fields or authentication data to unauthorized clients. Also, afterEvent Cloud Code trigger modifications can leak to other subscribers.

In Parse Server before versions 8.6.64 and 9.7.0-alpha.8, an attacker with a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests to the authData endpoint. This defeats the single-use guarantee of MFA codes, allowing session persistence even after the legitimate user revokes detected sessions.

In the go-git library (pure Go git implementation) versions 5.0.0 to before 5.17.1, a maliciously crafted .idx file can cause asymmetric memory consumption, potentially exhausting available memory and resulting in a denial-of-service (DoS) condition. Exploitation requires write access to the local repository's .git directory. This issue has been patched in version 5.17.1.

OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl alias parameters that bypass localRoots validation. Remote attackers can exploit this by routing file requests through unvalidated alias parameters to access files outside the intended sandbox directory.

OpenClaw before 2026.3.28 lacks rate limiting in Nextcloud Talk webhook authentication. Attackers can brute-force weak shared secrets to forge webhook events.

OpenClaw before 2026.3.28 has a vulnerability in the Google Chat and Zalouser extensions where group allowlist policies silently downgrade to open policy. Attackers can bypass sender restrictions and interact with bots.

OpenClaw before version 2026.3.28 downloads and stores inbound media from Zalo channels before validating sender authorization. Unauthorized senders can force network fetches and disk writes to the media store by sending messages that are subsequently rejected.

Checkmk version 2.5.0 (beta) before 2.5.0b2 contains a stored XSS vulnerability. Authenticated users with permission to create hosts or services can inject arbitrary JavaScript that executes in other users' browsers during Unified Search.

Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.

RAUC versions before 1.15.2 have an integer overflow vulnerability in 'plain' format bundles with payload size exceeding 2 GiB. The signature covers only the first bytes, allowing an attacker to modify the unsigned part.

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12 due to missing or incorrect nonce validation on the 'minify_html_menu_options' function, allowing unauthenticated attackers to update plugin settings via a forged request if they trick a site administrator into clicking a link.