CVE Vulnerability Catalog

Apache Roller 6.1.5 contains a Missing Authorization vulnerability that allows an authenticated user to read, modify, or delete weblog content belonging to other weblogs through the legacy XML-RPC Blogger and MetaWeblog APIs. The handlers authenticate the caller but do not verify the caller's permission on the weblog or entry actually affected. Only installations that enable the non-default global XML-RPC setting are affected; the per-weblog API flag defaults to enabled for UI-created weblogs.

A vulnerability was found in aaPanel BaoTa up to version 11.8.0 in the merge_split_file function of the file /www/server/panel/class/files.py in the File Merge Handler component. Manipulation of the split_file_path argument results in command injection, and the attack can be carried out remotely. The exploit has been made public and could be used; the vendor did not respond to the disclosure.

A security flaw was discovered in Netcore NBR200V2 version 1.3.241127.071246. Manipulation of the url argument in the system function of /usr/bin/network_tools within the Tools Ping Handler component results in OS command injection. The attack can be initiated remotely and the exploit has been publicly released.

Vulnerability in Netcore NBR200V2 1.3.241127.071246 in the eval function of /www/cgi-bin/network_tools in the web management interface. Manipulation of the QUERY_STRING argument leads to OS command injection. Remote attack possible, exploit publicly available.

Vulnerability in Netcore NBR100V2 1.3.240614.030928 in the uci.apply function of /usr/share/rpcd/acl.d/unauthenticated.json in the ACL Handler component. Manipulation of the section argument leads to missing authorization. Remote attack possible, exploit publicly disclosed.

Vulnerability in TOTOLINK N150RT 3.4.0-B20201030 in the system function of /boafrm/formWlSiteSurvey in the web management interface. Manipulation of the wlanif argument leads to OS command injection. Remote attack possible, exploit publicly available.

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 version 4.6.1.4-build202604241011. The affected element is an unknown function of the Debug Service component, leading to improper authentication. The attack can be launched remotely and the exploit is publicly available.

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the dashboard_host setting is empty, /api/v1/oauth2/{provider} reflects the attacker-supplied Host header into the redirect_uri. An attacker can steal the victim's authorization code and take over the account.

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to restricted MCP servers if they possess the server ID. Attackers can bypass authorization to access sensitive backend systems.

Obot up to commit d7e6970, when started via the Docker quickstart from README, listens on 0.0.0.0:8080 with authentication disabled. Every request is mapped to a synthetic 'nobody' user with Owner and Admin roles, granting full administrative access. The quickstart also mounts /var/run/docker.sock, giving access to the host's Docker control surface.

Memory overflow vulnerability in Citrix NetScaler ADC and Gateway leading to unpredictable or erroneous behavior or Denial of Service.

Memory overflow vulnerability in Citrix NetScaler ADC and Gateway leading to unpredictable or erroneous behavior or Denial of Service.

Memory overflow vulnerability in Citrix NetScaler ADC and Gateway leading to unpredictable or erroneous behavior or Denial of Service.

HTTP Request/Response Smuggling vulnerability in Citrix NetScaler ADC and Gateway due to inconsistent interpretation of HTTP requests.

A certificate with no dNSName SAN but another SAN type present bypassed the Subject CN dNSName name-constraint check. This incomplete fix from CVE-2026-6731 was introduced in wolfSSL version 5.9.2.

Eval injection vulnerability in hMailServer (versions 6.0.0-6.3.3) allows a remote, unauthenticated attacker to execute arbitrary JScript in the service process with service account privileges. It requires non-default configuration: event scripting enabled, JScript as script language, and an OnClientValidatePassword handler defined. Exploitation uses a password with backslash and apostrophe that is not properly escaped.

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail to detect all container image substitutions. A bad rebase during a Kata Containers update introduced an 'allow_storage' rule that accepts storage entries using the 'image_guest_pull' driver without verifying the image digest. An attacker with access to the Kata agent API can substitute a container image with an exploit payload if it satisfies the remaining policy rules.

A vulnerability in vm2 before 3.12.2 allows an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver and `context: 'host'`, guest code can require an allowlisted module and then an absolute path of a non-allowlisted sibling sharing the resolved prefix. This leads to a sandbox escape and arbitrary code execution in the host process.

A vulnerability in D-Link DIR-895L A1_102b07 affects the tunnel_set_params function in tunnel.c of the L2TP Control Channel Parser component. Manipulation results in an out-of-bounds write. The attack can be initiated remotely, and the exploit is now public.