CVE Vulnerability Catalog

A Relative Path Traversal vulnerability in Apache Kvrocks may allow attackers to access unauthorized system resources. The issue affects versions from 1.0.0 through 2.15.0.

An issue was found in GitLab EE that, under certain conditions, could allow an authenticated user with limited permissions to access project information due to insufficient authorization checks. It affects all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1.

In GitLab EE, a vulnerability was found that under certain conditions allowed an authenticated user with custom role permissions to view, create, or delete protected environment configurations even though CI/CD visibility was disabled for the project.

A Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plugin on Linux allows authenticated attackers to write to unintended file paths via crafted filename input. The impact is limited to file corruption as content cannot be controlled by the attacker.

In Appsmith prior to version 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration.

In Cacti versions 1.2.30 and below, the locale-dependent decimal formatting in rrdtool_function_update() can corrupt RRDtool metric values. When the server locale uses comma as decimal separator (e.g., de_DE), a value of 1.5 becomes '1,5', while RRDtool expects a dot. This causes metric data to shift into wrong columns or be silently dropped.

Gogs is an open source Git service that prior to version 0.14.3 was vulnerable to a panic error when rendering a specially crafted issue index pattern, resulting in denial of service.

Vulnerability in Rocket.Chat before versions 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12 where OAuth bearer or refresh tokens are not revoked when a user is deactivated. A deactivated user can continue using an existing access token or mint a fresh token from a refresh token.

Rocket.Chat prior to versions 8.5.0, 8.4.2, 8.3.4, 8.2.4, 8.1.5, 8.0.6, 7.13.8, and 7.10.12 allowed users deactivated through users.deactivateIdle to continue using already-issued login tokens. A user marked inactive by an administrator could still access authenticated REST endpoints with the old token.

Jellyfin prior to version 10.11.10 has a vulnerability that allows a specially crafted MKV file with forged filename tags to exploit missing path sanitization during playback. As a result, a malicious MKV file can redirect attachment extraction to any absolute path on disk.

Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name.

A vulnerability in ImageMagick before version 7.1.2-19 allows out-of-bounds access in the ConnectedComponentsImage() function when processing connected-components artifacts with invalid indices. Attackers can trigger access violations via CLI, leading to denial of service or potential code execution.

A memory leak vulnerability in ImageMagick before version 7.1.2-15 exists in multiple coders that write raw pixel data, where allocated objects are not properly freed. Attackers can trigger this leak by processing specially crafted images, leading to memory exhaustion and denial of service.

CVE-2026-13140 involves stored Cross-Site Scripting in the exposed AWS API key store of Thinkst Applied Research Canarytokens. Anonymous exploitation requires knowledge of a random identifier.

The Site Kit by Google WordPress plugin before version 1.176.0 does not properly restrict a REST API write endpoint to administrators, allowing lower-privileged users (such as Editors) to modify a site-wide setting that should only be modifiable by administrators.

NocoDB prior to version 2026.05.1 allowed low-privilege users to read files in shared storage, including attachments belonging to other bases and workspaces, if they knew the attachment path. This issue was due to the MCP readAttachment tool not verifying file ownership.

NocoDB, software for building databases as spreadsheets, had an issue with deleting API tokens. Prior to version 2026.04.4, deleted tokens continued to authenticate requests until their cache entry expired.

NocoDB is software for building databases as spreadsheets. Prior to version 2026.04.1, the upload-by-URL path did not enforce the NC_ATTACHMENT_FIELD_SIZE limit, allowing an authenticated user to bypass the configured per-file size limit.

In NocoDB prior to version 2026.04.1, an OAuth token with a restricted scope (e.g., MCP-only) inherited full user permissions across all routes. The granted_resources.base_id restriction was bypassed on org-level endpoints that do not populate req.context.base_id.

Pi, a minimal terminal coding harness, from version 0.74.0 to 0.78.1 stores API keys and OAuth credentials in auth.json. A race condition in the file write path could briefly create or rewrite this file with permissions derived from the process umask before tightening the file to owner-only permissions.