CVE Vulnerability Catalog

Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermission configuration, causing the permission interceptor to skip RBAC validation for authenticated users. Attackers with any valid login token can retrieve sensitive user information including account names, real names, email addresses, phone numbers, last login IPs, and role assignments for all users in the system.

A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the index function of the file UserController.java of the component top.upstudy.crm.controller.UserController. The manipulation results in missing authorization. The attack can be launched remotely. This product does not use versioning, so information about affected and unaffected releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the requesting user was authorized to edit, and did not enforce page-view permission before generating page-backed summary content. As a result, an authenticated user holding edit-board-contents permission on a single board instance could submit the identifier of an item belonging to a different board instance and receive summary fields, including the page title and description, of an underlying page the same user was otherwise forbidden to view. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3.

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Remote execution.

oras-go before version 2.6.2 does not validate the scheme, host, or port of a URL taken from a registry-controlled Link response header. During pagination operations (Tags, Referrers, Repositories), a GET request is issued to an attacker-selected URL, enabling blind server-side request forgery against internal services.

Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. An unauthenticated visitor could store an XML document with an xml-stylesheet processing instruction referencing an attacker-supplied same-origin XSLT stylesheet, leading to stored XSS in the Concrete CMS origin.

MikroORM before versions 6.6.16 and 7.1.7 does not validate the direction value of an orderBy clause before concatenating it into an ORDER BY statement. Applications that bind attacker-controlled data to the sort direction in em.find(), em.findOne(), em.findAndCount(), QueryBuilder.orderBy(), or QueryBuilderHelper.getQueryOrderFromObject() may allow SQL fragment injection and blind data extraction.

Composer from 1.0 to 2.2.30 and from 2.3.0 to 2.10.3 allows a malicious or compromised dependency to bypass the earlier binary-path hardening from CVE-2026-59946. Through an in-package symlink or installed.json metadata, an attacker can point to a binary path outside the installation directory, and Composer may change the external file's permissions and create a runnable vendor/bin proxy.

vLLM before version 0.24.0 in the input_audio handling path for /v1/chat/completions does not pass VLLM_MAX_AUDIO_DECODE_DURATION_S to the shared audio decoder. An unauthenticated client can submit a small compressed audio input that expands into a very large float32 PCM allocation, bypassing the duration guard and causing an out-of-memory worker crash.

HDF5 before version 1.14.2 contains a heap-use-after-free vulnerability in H5T__conv_f_f() in src/H5Tconv.c. When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read within the same conversion routine.

In flightctl, the configureRepoHTTPSClient() function in the device-render worker builds a per-repository TLS configuration and installs it into go-git's process-global client.Protocols map. Because the worker renders devices for multiple organizations concurrently from a shared goroutine pool, the last tenant's TLS configuration wins for all in-flight git.Clone calls.

Dell ObjectScale versions prior to 4.4.0.0 contain an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contain an Improper Privilege Management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

A flaw was found in the first-broker-login flow of the keycloak-services component. It allows an attacker to register a matching username on an external identity provider, causing a collision in Keycloak and locking out the legitimate user.

FileRise before version 3.28.0 contains a privilege escalation vulnerability that allows authenticated low-privilege attackers to gain unauthorized read and write access by exploiting improper session isolation between the WebDAV interface and the web application session context. Attackers can combine valid Basic-Auth credentials with an active admin PHPSESSID cookie to bypass authorization boundaries.

An authorization bypass vulnerability in reNgine through 2.2.0 in the GetFileContents API endpoint allows any authenticated user to read bundled recon tool configuration files. Low-privilege Auditor roles can access files containing third-party API keys for services like SecurityTrails, Shodan, Censys, VirusTotal, BinaryEdge and Hunter.

A server-side request forgery vulnerability in Hippo4j through 1.5.0 in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud metadata services.

A server-side request forgery vulnerability in MLRun through 1.11.0 in the WebhookNotification handler allows authenticated users to make the API server send arbitrary HTTP requests to internal addresses. Attackers can update a run with a malicious webhook notification that executes when the run reaches a terminal state, enabling requests to internal services, Kubernetes APIs, or cloud metadata endpoints from within the cluster.

An authorization bypass vulnerability in TDuck survey form through version 5.0 in the POST /user/form/data/update endpoint allows authenticated users to overwrite other users' form submission data. Attackers can discover submission identifiers allocated in narrow ranges and modify arbitrary form responses containing personal data by sending update requests without ownership validation.

An information disclosure vulnerability in Rallly before 4.15.0 in the polls.get tRPC procedure returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.