CVE Vulnerability Catalog

YesWiki prior to version 4.6.6 contains a stored Server-Side Template Injection (SSTI) vulnerability in the semantic template feature that can be escalated to Remote Code Execution (RCE). An authenticated administrator can place arbitrary Twig expressions into the Semantic template field, which are executed server-side when public semantic endpoints are requested.

ntop nDPI before version 6.0 has a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller-supplied buffer boundaries. Attackers can trigger it with crafted network packets containing TLS SNI, HTTP headers, or DNS names, causing heap corruption.

Unidata netcdf-c through 4.10.1 has an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Crafted HDF5 files with oversized attribute names can overflow the buffer, causing memory corruption and crashes.

Laravel before versions 12.60.0 and 13.10.0 has a CRLF injection vulnerability in email validation, which combined with Symfony Mailer and Symfony Mime handling of certain character sequences, may allow an unauthenticated attacker to interfere with outbound email processing. Patched in 12.60.0 and 13.10.0.

ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools and member bindings. Attackers can issue POST requests to irreversibly destroy every host pool, removing traffic policy bindings and visibility restrictions.

ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users can issue POST requests to irreversibly delete all configured notification endpoints and recipients, silencing all alerts.

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract system credentials, configurations, or flash contents.

In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected.

Twig from version 1.0.0 to before 3.27.0 has a vulnerability in SecurityPolicy::checkMethodAllowed() that unconditionally whitelists all method calls on instances of Twig\Markup. Since Twig\Markup is not final, subclasses inherit the bypass. An application passing an object of a Markup-derived class into a sandboxed template inadvertently exposes every public method of that subclass to template authors. Patched in 3.27.0.

A security vulnerability has been detected in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. It affects the _conversation function in server/backend.py of the Backend Conversation API. Manipulation of the model argument leads to missing authentication. The attack can be launched remotely. The exploit has been publicly disclosed. This product operates on a rolling release basis, so no version details are available. This vulnerability only affects products no longer supported by the maintainer.

Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to Cross-Site Request Forgery (CSRF). An attacker could exploit this to perform state-changing operations on the device.

In CRMEB v6.0.0, there is an arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component. An authenticated attacker can delete arbitrary files via a crafted POST request.

An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request.

An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component.

Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function.

Amazon ion-java before 1.12.1 improperly handles highly compressed data, potentially allowing remote attackers to cause a denial of service via a crafted compressed Ion document that expands to an arbitrarily large size upon decompression due to insufficient coverage of the GZIP auto-decompression opt-out introduced for CVE-2026-75936.

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational data, including device identifiers, message metadata, and control-related information.

Trueview T18161 S 6.0.23.4 contains improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the associated commands.

An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRequest.php, and WebhookSingle.php components.

SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php component.