CVE Vulnerability Catalog

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.

http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate Vary header wildcards due to byte-for-byte string comparison. Attackers can request URLs previously fetched by other clients to receive cached responses intended for different users, disclosing sensitive information across clients.

A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.

A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access.

A flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies.

A flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens.

md-editor-v3 is a Markdown editor for Vue 3 developed in JSX and TypeScript. Prior to 6.5.4, MdPreview's useMarkdownIt() highlight callback in packages/MdEditor/layouts/Content/composition/useMarkdownIt.ts inserts a fenced-code language value into class and language HTML attributes without escaping or consistently quoting it. Both highlighted and non-highlighted rendering paths reach this return value, while XSSPlugin filters only existing html_block and html_inline tokens before rendering and therefore cannot inspect the renderer-generated HTML. An attacker who can supply Markdown can use crafted fenced-code metadata to execute JavaScript in the application origin when a victim renders it, including as stored cross-site scripting when the host persists the Markdown. This issue is fixed in version 6.5.4

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/{provider} appended the provider, token, and error values before redirecting the victim's browser without validating the destination. Because the one-use token was not bound to the browser session that initiated login, an attacker who induced a victim to complete OIDC authentication could capture the token at the attacker-controlled destination and exchange it through /auth/oidc/callback/{provider} for the victim's Kyoo session. This issue is fixed in version 5.1.0.

In Kyoo media server prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. Path handling only checked the Settings.SafePath prefix and did not verify a Kyoo catalog record, allowing retrieval of hidden, temporary, or uncataloged files under the media directory when the path was known or guessed.

In Paymenter prior to 1.5.7, doUpgrade() relied on Service::upgradable to check for a pending upgrade and then incremented credit without a DB transaction or lock. An authenticated customer with an active downgradable service could submit concurrent downgrade requests, creating multiple upgrade records and incrementing the same credit balance multiple times.

In c-ares prior to 1.34.7, ares_dns_parse() trusted attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming the DNS response contained enough bytes. A malicious DNS response could cause disproportionate heap allocation for a tiny message, degrading or denying name resolution.

In AnyIO prior to 4.14.2, process-pool workers were started with stderr connected to a pipe the parent never drained. Worker code writing enough data to sys.stderr could fill the pipe and block before returning the response, causing the awaiting process-pool call to remain blocked indefinitely.

A flaw was found in Netty's HTTP/2 stack that allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting.

In the Self Update Handler component of spatie Scotty up to version 1.4.2, there is a vulnerability where code is downloaded without an integrity check. The SelfUpdater::update function allows remote exploitation.

In the Doctor Command Handler component of spatie Scotty up to version 1.4.4, there is an OS command injection vulnerability via the host argument. The DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions allow remote attack.

The Grandstream GWN7660ELR device before firmware version 1.0.27.6 contains an information disclosure vulnerability. An unauthenticated remote attacker can query the SNMP v2c service configured with the default community string 'public' to retrieve detailed system information.

In cockpit-ws, there is a denial-of-service (DoS) vulnerability. A remote unauthenticated attacker can send a specially crafted request that, when WebService.UrlRoot is configured and the exact URL-root prefix is requested without a trailing slash, causes the service to terminate unexpectedly.

Semantic MediaWiki versions 7.0.0 through 7.1.0 contain a reflected XSS vulnerability in Special:Ask. The 'cursor' parameter is unsigned and fully attacker-controlled; insufficient validation leads to raw HTML injection into the page.

Prior to version 7.2.0, query debug output (format=debug or the 'debug' parameter on Special:Ask) in Semantic MediaWiki is assembled as raw HTML without proper output-context encoding, leading to reflected XSS.