CVE Vulnerability Catalog

In Hoppscotch prior to version 2026.6.0, mock server creation in mock-server.service.ts does not persist the isPublic input field, while schema.prisma defaults isPublic to true. This causes mock servers linked to private collections to be publicly accessible without authentication, potentially exposing sensitive API data.

A vulnerability in Open WebUI before version 0.10.0 allows bypassing proxy path normalization by encoding the '../' sequence nine times in percent-encoded format. The _sanitize_proxy_path function decodes paths only eight times, enabling an attacker to access files outside the allowed directory.

Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.

In Discourse versions prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, under certain non-default configurations, processing of PDF uploads could be exploited to achieve remote code execution (RCE) on the server. The vulnerability is patched in the mentioned versions.

In Open WebUI prior to 0.10.0, the WebSocket terminal URL was built from an unencoded session_id, allowing query injection to impersonate another user. The HTTP proxy also forwarded X-User-Id without integrity checks, enabling identity manipulation.

In Open WebUI before version 0.10.0 with Redis configured, real-time connection authentication (Socket.IO, WebSocket) used decode_token without the Redis-backed is_valid_token revocation check, allowing revoked JWTs to continue authenticating.

A vulnerability in Open WebUI before version 0.10.0 allows authenticated users to execute Python code or tools in another user's session. An attacker can exploit Socket.IO events to hijack a victim's session after learning their socket ID.

Open WebUI prior to 0.10.0 runs client-side Python with Pyodide in a same-origin web worker, allowing stored chat payloads using pyodide.http.pyfetch or the js module fetch and XMLHttpRequest APIs to issue authenticated same-origin requests when a victim clicks Run, which can reach admin-only endpoints and execute server-side code through configured tools.

In gpsd up to release 3.27.5 (fixed in commit 4c06658), a command injection vulnerability exists in the gpsprof tool. An attacker controlling the GPS device subtype value can embed backtick payloads in the gnuplot plot title, leading to arbitrary shell command execution when the victim renders the plot.

An improper input handling vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) causes the device to abruptly terminate the TCP connection with a RST packet when a request containing an oversized field value is received, without returning any RFC 2326-compliant error response. This behavior affects the request-line URL field and header field values across multiple RTSP request types.

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.991) allows an unauthenticated remote attacker to cause a denial of service via a crafted TEARDOWN request.

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted PLAY request.

A stack-based buffer overflow vulnerability exists in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91). An unauthenticated remote attacker can cause a denial of service by sending a crafted second SETUP request, crashing the RTSP service.

A stack-based buffer overflow vulnerability in the RTSP service of Tenda CP3 V3.0 (firmware V31.1.9.91) allows an unauthenticated remote attacker to cause a denial of service via a crafted SETUP request. The second-stage URL parser fails to validate the URL length, enabling an attacker to bypass first-stage validation and trigger a stack buffer overflow, causing an immediate crash of the RTSP service and making the device inaccessible to all clients on the local network.

Tenda CP3 V3.0 firmware V31.1.9.91 contains a stack-based buffer overflow in the RTSP service. The device fails to validate the length of the clock= value in the Range header field when processing a PLAY request, which can cause the service to crash.

Tenda CP3 V3.0 firmware V31.1.9.91 fails to validate the Content-Length header in RTSP requests (DESCRIBE, SETUP, PLAY). When a request includes this header without a body, the RTSP parser enters a persistent body-awaiting state, permanently blocking the TCP connection. An unauthenticated remote attacker can exploit this to exhaust TCP resources and cause a denial-of-service condition.

The incremental HTML parser (html.parser.HTMLParser) allows CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data.

A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the /login.php file. An attacker can remotely manipulate the Username argument, leading to unauthorized database access. The exploit is publicly available.

PayRange Android app version 7.0.7 and below has an SSL bypass vulnerability that allows invalid certificates to be accepted in application webviews. A remote, unauthenticated attacker can steal information sent by the user.

In n8n, an open source workflow automation platform, prior to versions 1.123.61, 2.27.4, and 2.28.1, an authenticated user with the default workflow:create permission could pollute Object.prototype through a crafted workflow saved, updated, or imported via the workflow API. This allowed unauthenticated requests to be treated as a privileged user and exposed user and project listing endpoints.