CVE Vulnerability Catalog

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an independent distribution setting that can be more restrictive than the parent event's distribution, an authenticated user who had read access to the event could retrieve and view a report whose distribution explicitly excluded that user. Additionally, the query did not filter out soft-deleted reports, allowing retrieval of reports that had been administratively removed.

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $_CMS['site'] results in code injection. The attack may be performed from remote. The exploit has been made public and could be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The vendor was contacted early about this disclosure but did not respond in any way.

SGLang contains a DoS vulnerability caused by missing input validation for AUX_DATA ZeroMQ control messages in the Decode worker, which enables an unauthenticated remote attacker with network reachability to the Decode control PULL socket to terminate the Decode control thread and cause a denial of service against the target server.

MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by supplying an arbitrary vendor user ID. Attackers can bypass authorization controls by submitting a target vendor ID in the request to access payout pages, financial reports, and vendor dashboard content belonging to any vendor in the marketplace.

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause exposure of sensitive system information due to uncleared debug information. A successful exploit of this vulnerability might lead to information disclosure.

A vulnerability in NVIDIA Infrastructure Controller for Linux allows an attacker to cause improper enforcement of a behavioral workflow. Successful exploitation might lead to data tampering, denial of service, and information disclosure.

A vulnerability in NVIDIA Infrastructure Controller for Linux allows an attacker to cause external control of a file name or path. Successful exploitation might lead to code execution, privilege escalation, data tampering, and denial of service.

A vulnerability in NVIDIA Infrastructure Controller allows an attacker to cause an XML injection. Successful exploitation might lead to data tampering and denial of service.

A vulnerability in NVIDIA Infrastructure Controller for Linux involves the use of a hard-coded password. Successful exploitation might lead to data tampering, denial of service, and information disclosure.

A vulnerability in NVIDIA Infrastructure Controller allows an attacker to cause uncontrolled resource consumption. Successful exploitation may lead to denial of service.

A vulnerability in NVIDIA Infrastructure Controller allows an attacker to cause uncontrolled resource consumption. Successful exploitation might lead to denial of service.

MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name is interpolated directly into a JavaScript string literal without proper output encoding, allowing injection of arbitrary JavaScript. The injected script executes in the context of any authenticated user who loads the page, potentially enabling session hijacking, data exfiltration, or privileged actions.

MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. Due to a logic error in the readFile guard condition in the Xml::build() library, a request containing a bare HTTPS URL can be fetched by the server as a resource. An unauthenticated attacker can send a crafted POST request to the cspReport endpoint to cause the server to issue an outbound HTTPS request to an arbitrary target reachable from the server, enabling scanning of internal services or attacks on internal endpoints.

In MISP, the queryEnrichment method in EventsController.php accepts a module name and iterates over the list of enabled modules. If the module is not found, the code continues with default parameters instead of rejecting the request, allowing an authenticated user to trigger enrichment via a module that was not enabled, bypassing availability controls.

In MISP, the add() method in CollectionsController enforces sharing-group authorization only for POST requests, but CRUDComponent::add() persists data on both POST and PUT. An authenticated user can send a PUT request to collections/add to create a collection with distribution=4 (shared with a specific group) without proper authorization, bypassing the access control.

MISP installer scripts for Debian 12, Debian 13, Ubuntu 24.04, and RHEL 9.4 create a log file at /var/log/misp_install.log and a named pipe (FIFO) at /var/log/misp_install.log.pipe that capture sensitive data including admin, database, GPG, and supervisor passwords. These files are created with the system default umask, resulting in world-readable permissions (typically 0644). Additionally, the log file is not removed before creation, allowing a pre-existing symlink to redirect writes to an arbitrary location. Affected versions are <2.5.47.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to limit the length of the post ID array accepted by the bulk reactions endpoint, allowing an authenticated user to cause excessive database load via a crafted request to {{POST /api/v4/posts/ids/reactions}}. Advisory ID: MMSA-2026-00771.

MISP contains a reflected cross-site scripting (XSS) vulnerability in the event REST search export confirmation form. The view template app/View/Events/ajax/eventRestSearchExportConfirmationForm.ctp renders a URL-supplied event ID list into a single-quoted JavaScript string literal using PHP's json_encode() without hex-encoding flags, allowing an attacker to inject a single-quote character and execute arbitrary JavaScript. The vulnerability affects the Default and UiBeta themes; the Overmind theme is not affected by this specific sink.