CVE Vulnerability Catalog

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message.

amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a malicious AMQP broker can force the client to allocate resources and process content body frames exceeding the frame_max limit. This can lead to unexpected memory consumption or application-layer DoS, bypassing protocol constraints. Version 1.13.0 contains a fix. No workarounds are known.

Weblate prior to 2026.8 allows a user with permission to manage component repository URLs to perform SSRF against internal services through DNS rebinding during VCS operations. Hostname validation uses the first DNS resolution, but VCS clients perform a separate lookup, allowing redirection to an internal address.

Weblate prior to version 2026.8 does not apply permission checks in object-scoped RSS feeds, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations with anonymous access, metadata can be retrieved without authentication. This issue is fixed in version 2026.8.

AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage.

In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command execution vulnerability.

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath.

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter. User-controlled input is concatenated via sprintf() into the unquoted shell command `/etc/rrd/graphinterface %s %s` and executed by system() with root privileges. A remote authenticated attacker can inject arbitrary commands.

A vulnerability in Comfast CF-WR630AX router version 2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config components and the timestr, display_n parameters.

Weblate prior to version 2026.7 allows a user with the "Edit source" role to store a malicious regular expression in a source string's flags that is executed without any timeout, allowing them to stall requests and deny service. This issue is fixed in version 2026.7.

Weblate prior to version 2026.7 allows an authenticated user with access to a project to retrieve the change history of restricted components in that project through nested API change endpoints, even without permission to view those components directly. This issue is fixed in version 2026.7.

Weblate is a web-based continuous localization platform. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without confining them to the repository. This is an incomplete fix for CVE-2026-34242, allowing arbitrary file read. A user with project-admin privileges can disclose file contents on the host. Fixed in 2026.7.

Weblate prior to version 2026.7 does not enforce two-factor authentication (2FA) requirements for site-wide global permissions, even though a team can require 2FA for its members. A user belonging to a team with 2FA enforcement receives global permissions without 2FA configured, potentially including access to the site management interface. This issue is fixed in version 2026.7.

Weblate is a web-based continuous localization platform. In versions prior to 2026.7, the REST API did not properly enforce team scopes, allowing users to submit invalid team configurations. By assigning projects to teams via unvalidated requests, users could grant access to unauthorized projects. This could expose private projects and allow operations outside intended permissions. Fixed in 2026.7.

Weblate is a web-based localization tool. In versions prior to 2026.7, several endpoints look up objects in a globally scoped manner rather than restricting the lookup to projects the user can access, so they return HTTP 403 (Forbidden) instead of 404 (Not Found) when a user requests an object they are not authorized to see. This difference lets unauthorized users infer whether a given object exists in a private Weblate project. The issue has been fixed in version 2026.7.

A vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges because the content parameter is directly concatenated to the ProcessBuilder.

A zero-click remote code execution vulnerability in SimpleX Chat before v6.5 in the /Terminal/Notification.hs component allows attackers to execute arbitrary commands in the context of the application without user interaction by sending a crafted payload in a text message.

A Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code in the victim's browser via the item.php, field-select.js and tags.js components.

LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the Survey Menu Entries admin page. An authenticated user with global settings:read permission can create a survey menu entry with attacker-controlled data. The value is stored and later inserted into a single-quoted HTML title attribute without proper encoding.