CVE Vulnerability Catalog

Vulnerability in HTTP::Tiny for Perl before version 0.095 causes credential headers (Authorization, Cookie, Proxy-Authorization) to be forwarded to cross-origin redirect targets. The redirect mechanism does not verify whether the redirect target shares an origin with the original URL, allowing sensitive data leakage.

The GET /api/v1/public/:accessId/portfolio endpoint in Ghostfolio does not validate granteeUserId filtering, allowing unauthenticated attackers to retrieve full portfolio data using a private access ID.

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

CVE-2026-48957 is an improper access check vulnerability that allows unauthorized users to access com_privacy datasets. The issue affects the authentication mechanism in the privacy management component.

An improper access check in the com_contact component allows a user to download vcard exports of contacts that are inaccessible.

The KernCoreLib64.sys kernel driver in MSI Feature Manager has a local privilege escalation vulnerability. Any locally logged-on user can perform arbitrary physical memory read/write and unrestricted I/O port operations via exposed IOCTL handlers.

Vtiger CRM up to version 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature. An administrator can upload a crafted ZIP archive that extracts arbitrary PHP files into the modules/ directory under the web root without validating file types beyond manifest.xml.

Vtiger CRM before version 8.4.0 contains an authenticated file upload vulnerability that allows low-privileged users to achieve remote code execution by uploading a .phar file with arbitrary PHP code via the Documents module. The vulnerability is due to the omission of the .phar extension from the denylist in config.inc.php and a misconfigured .htaccess file that is silently ignored on Apache 2.4 deployments.

A weak password recovery mechanism for forgotten passwords exists in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux, and Kubernetes. A remote, unauthorized attacker may assume ownership of a user's account by manipulating this mechanism.

A vulnerability in the Phoenix Presence JavaScript library allows an attacker with ordinary channel access to cause a persistent client-side denial of service against every viewer of a presence channel topic. The issue stems from an improper existence check using a truthiness test instead of an own-property check, enabling the use of keys like '__proto__' or 'constructor'.

A vulnerability in the Phoenix.Socket module of the Phoenix framework allows an unauthenticated attacker to perform a DoS attack by sending a large number of phx_join messages over a single WebSocket or LongPoll connection. This exhausts the BEAM virtual machine process limit, blocking legitimate traffic across the entire node.

The AMP for WP – Accelerated Mobile Pages plugin for WordPress up to version 1.1.12 contains an arbitrary file write vulnerability. It is due to unsafe ZIP extraction in the ampforwp_save_local_font() function and inadequate cleanup that fails to remove nested directories and files.

Dell PowerProtect Data Domain products in multiple versions contain an OS command injection vulnerability. This flaw allows a remote high-privileged attacker to bypass protection mechanisms.

A vulnerability in Fleet allows an attacker with git push access to overwrite Pod Security Standards (PSS) enforcement labels on a target namespace. This occurs because the agent-side deployer does not filter security-sensitive keys from namespaceLabels in fleet.yaml.

An LDAP injection vulnerability in HAVELSAN Inc. Liman MYS allows an attacker to manipulate LDAP queries due to improper neutralization of special elements. The issue affects versions before release.Master.1107.

An improper verification of cryptographic signature vulnerability in HAVELSAN Inc. Liman MYS allows fake the source of data. This issue affects Liman MYS versions before release.Master.1107.

A missing authorization vulnerability in HAVELSAN Inc. Liman MYS allows accessing functionality not properly constrained by ACLs. This issue affects versions before release.Master.1107.

A path traversal vulnerability was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.

A heap buffer overflow flaw was found in the SASL I/O layer of 389 Directory Server (389-ds-base). An authenticated attacker can send a specially crafted oversized LDAP UNBIND packet that overflows a 512-byte heap receive buffer without bounds checking, causing a denial of service (server crash).