CVE Vulnerability Catalog

Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml registers the preview access voter as Contao\CoreBundle\Security\Voter\DataContainer\PreviewAccessVoter although the shipped class is PreviewVoter. Symfony therefore omits voter autoconfiguration and removes the private service, so PreviewVoter::hasAccess() never enforces ownership. A non-admin backend user with the preview_link module can list every tl_preview_link record, obtain signed share URLs created by other users, and use them to view unpublished pages with showUnpublished despite lacking page permission. The advisory does not establish editing or deletion of foreign links. This issue is fixed in version 5.7.12.

Contao from version 4.0.0 to 5.3.50 and 5.7.12 has a CSRF vulnerability because RequestTokenListener validates the token only for POST requests, and the GET guard runs only when an act parameter is present. Backend actions via the key parameter can execute without a CSRF token when an authenticated user loads a malicious URL. Fixed in versions 5.3.50 and 5.7.12.

iStoreOS in version istoreos-24.10.7 and earlier has a vulnerability that allows a remote attacker to execute arbitrary code via the task_id parameter in tasks-lib.lua.

In versions from 4.0.0 until 5.3.50 and 5.7.12, Contao (an Open Source CMS) renders comment email or website metadata without sufficient attribute and URL encoding in listComments(). An unauthenticated visitor can submit a comment with malicious script that executes in the backend context when a user opens the Comments module. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 5.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ImagesController that joins the user-controlled {path} parameter to the image target directory without verifying the canonical path stays within that directory. An unauthenticated attacker can use encoded parent-directory segments to access files under the project directory if their extensions are allowed. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 4.1.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleRegistration::compile() that allows the follow-up registration branch to be entered on any POST to a page with the registration module without verifying FORM_SUBMIT or the captcha result. resendActivationMail() can then invoke OptInToken::send() without rate limiting, allowing an unauthenticated attacker to send repeated activation emails and determine if a pending registration exists. This issue is fixed in versions 5.3.50 and 5.7.12.

Contao, an Open Source CMS, versions 4.0.0 through 5.3.50 and 5.7.12, has a vulnerability in ModuleSearch that can disclose protected page titles, URLs, and indexed context snippets to unauthenticated visitors when contao.search.index_protected is changed from enabled to disabled. Authorization metadata is stored per row in tl_search, but disabling the setting removes the protected-row filter without deleting rows indexed while protection was enabled. This issue is fixed in versions 5.3.50 and 5.7.12.

This CVE number has been rejected and should not be used. It is a reservation duplicate of CVE-2026-73364. All references and descriptions have been removed to prevent accidental usage.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It contains no vulnerability information.

Rocket Software Rocket Remote Desktop version 18.0.8583.1 is vulnerable to insufficiently protected credentials. This means that authentication data may be stored or transmitted without adequate protection.

OpENer v2.3/commit 76b95cf contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

OpENer v2.3/commit 76b95cf contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

OpENer v2.3 (commit 76b95cf) contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service.

AWS Amplify API Category before version 3.1.2 has a vulnerability in the query resolvers generated by @aws-amplify/graphql-index-transformer that might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2.

pacioli, a least-privilege governance tool for ERPNext, versions 0.9.6 through 0.10.0, has a vulnerability in the pacioli-guard document-layer consent gate that allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether the marker authorizes cancellation. A credential with API Key Scope.require_consent can submit a caller-controlled document under a valid marker and reach Document.cancel() for a different pre-existing document, bypassing the marker's binding, single-use spend, and denial audit. This issue is fixed in version 0.10.0.

yopass before version 14.7.0 uses the attacker-controlled r.Method value directly as the method label for Prometheus metrics. An unauthenticated remote attacker can submit many unique methods and create metric series that are never evicted, leading to unbounded memory growth and potential OOM-kill.

ageLANServer before version 1.15.2 has no request body size limit or cap on the attacker-controlled JSON names array in the POST /game/cloud/getFileURL handler. A remote unauthenticated client can send an oversized request causing excessive memory allocation, crashes or hangs the server.

RIOT from version 2023.07 through 2026.07 ignores a failure returned by _resp_init() in nanocoap_fileserver when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a large extended token, causing response initialization to fail and leading to an assertion that terminates the service or task.

RIOT in 2026.07 and earlier, the _receive() function in gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. A remote attacker can send a malformed 6LoWPAN fragment causing read beyond the packet buffer, potentially disclosing memory and crashing the network stack.