CVE Vulnerability Catalog

In New API, an LLM gateway and AI asset management system, the default SSRF protection configuration did not apply IP filtering to hostnames. With ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve hostnames to IP addresses, allowing authenticated users to configure Webhook, Bark, or Gotify notification URLs pointing to internal or metadata IP addresses.

Cotonti Siena 0.9.26 and earlier contains a cross-site request forgery vulnerability that allows unauthenticated attackers to modify administrator configuration by tricking a logged-in administrator into submitting a forged POST request to the admin.php config update handler, which never invokes the application's CSRF validation function. Attackers can disable the PFS module's file extension whitelist by setting pfsfilecheck to 0, enabling any user with PFS access to upload and execute arbitrary PHP files on the server.

An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Juniper Networks Junos OS Evolved allows an unauthenticated, network-based attacker to cause license exhaustion. Due to incorrect initialization, a process that should only communicate internally can be reached over the network via an open port, leading to unauthorized access to license management.

The SIP plugin in Junos OS on MX Series with SPC3 and SRX Series improperly validates the syntactic correctness of incoming SIP packets. An unauthenticated attacker can send a malformed INVITE packet, causing a flowd crash and restart, leading to a complete service outage.

An improper validation of specified quantity in input vulnerability in the TCP proxy plugin of Juniper Networks Junos OS on MX Series with SPC3 and SRX Series allows an unauthenticated, network-based attacker to cause a complete Denial of Service (DoS) by sending a TCP packet with a malformed header, crashing the flowd process.

A vulnerability in DeepSeek MCP Server allows an attacker to hijack user sessions by enumerating session IDs and reusing them in chat requests. The issue affects versions 1.4.2 through 1.7.0, where the global session store does not validate session ID authenticity.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, a malicious second factor name on an attacker-controlled account was not escaped in the delete confirmation dialog, allowing stored cross-site scripting when an administrator impersonated that account.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, restricted tag and tag-group names attached to publicly readable categories as allowed_tags, allowed_tag_groups, or required tag groups could leak to anonymous and unauthorized users through category and group endpoints.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the pull_hotlinked_images function could expose secure uploads if an attacker knew the secured upload URL and the secure_uploads site setting was enabled.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, the signup flow allowed newly registered users to set primary_group_id and gain whisper-group privileges without legitimate group membership on sites with whispers_allowed_groups configured.

The 'decompress' library before version 4.2.2 allows arbitrary symlink creation during archive extraction. An attacker can craft an archive with symlink entries pointing to sensitive files outside the extraction directory, leading to information disclosure.

An integer overflow in the jbig2_arith_iaid_ctx_new() function of the Artifex library allows an attacker to cause a Denial of Service (DoS) via a crafted input.

A security vulnerability has been detected in TOTOLINK devices (models A3000RU, A3100R, A950RG, AC1200T10, CP450, CS185R_T10, EX200) up to version 20260906. An unknown functionality in the file /etc/boa/boa.conf of the web interface leads to a least privilege violation. The attack can be initiated remotely but is considered difficult to exploit.

Python Liquid prior to version 2.2.1 contains a vulnerability that causes an infinite loop during parsing of malformed {% case %} tags without corresponding {% when %}, {% else %}, or {% endcase %} blocks. The issue arises because liquid.TokenStream.eof does not return an EOF token with matching kind and value fields, enabling a denial of service attack.

In Pimcore before versions 2025.4.6 and 2026.1.6, the Studio API class definition creation endpoint was guarded by the 'objects' permission instead of 'classes', allowing editor-level users to create class definitions without admin privileges. Missing UID format validation in the API layer allowed malformed UIDs to reach model-layer validation and expose internal exceptions.

A vulnerability in Pimcore Studio Backend Bundle allows an authenticated user to extract the admin password hash and other database content through time-based blind SQL injection in the DateFilter column key parameter. The input is interpolated directly into SQL with manual backtick wrapping, allowing a backtick character to break out of quoting and append arbitrary SQL.

In Pimcore before versions 2025.4.6 and 2026.1.6, an unauthenticated attacker who knows a valid admin username can take over any admin account by sending a password reset request with an attacker-controlled resetPasswordUrl. The server generates a real recovery token, appends it to the supplied URL, and emails the link to the victim; when the victim clicks the link, the token is sent to the attacker and can be used to authenticate with full admin privileges while bypassing two-factor authentication.

An issue in FSM Client v.11.11c by docuForm GmbH allows a remote attacker to obtain sensitive information via the login.php component. The authentication mechanism enables user enumeration through variations in server responses.

A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c in the dfm-menu_report.php component. A remote attacker can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files, potentially leading to arbitrary code execution.

A vulnerability in docuForm GmbH Client version 11.11c allows a remote attacker to execute arbitrary code via the file upload mechanism and the report.php component.