CVE Vulnerability Catalog

In Prebid Server Java prior to 3.43.0, certain bidder adapters interpolate user-supplied parameters into outbound request URLs without using HttpUtil to validate the resulting domain or path segment. A malicious actor who can supply bid-request parameters can cause the server to send HTTP requests to unintended destinations, including internal services or metadata endpoints.

In WeGIA prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive ContribuicaoLogController operations from authentication, and constructs a controller include path without canonical directory containment. An unauthenticated attacker can invoke sensitive methods, disclose contribution and donation records, trigger financial operations, and include files outside the intended controller directory.

Use after free in Dawn in Google Chrome on Android prior to 153.0.8010.52. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Use after free in Extensions in Google Chrome prior to 153.0.8010.52. A remote attacker could execute arbitrary code outside the sandbox via a crafted Chrome extension. (Severity: High)

Buffer overflow in WebGL in Google Chrome on Android prior to 153.0.8010.52. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

In Browsertrix from 1.15.0 until 1.22.8, improper sanitization of Git URLs specified as Custom Behaviors allows command injection through /api/orgs/*/crawlconfigs/validate/custom-behavior. A user with crawler or administrator permission can supply a crafted Git URL that executes arbitrary operating-system commands in the backend pod.

In OpenReception prior to 1.1.1, the POST /api/auth/passkeys endpoint accepts a request-body userId and an attacker-supplied passkey without an authenticated session, does not call WebAuthnService.verifyRegistration, and does not bind enrollment to locals.user.id. An unauthenticated attacker who knows the public tenant ID and the target staff email can inject a controlled public key, identify the matching userId, and create a STAFF session.

In Wavelog from 1.8 until 2.4.2, the files /install/ajax.php and /install/includes/interface_assets/triggers.php remain accessible after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile(), allowing an unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files that can execute on the server.

In Chamilo LMS from 2.0.0 through at least 2.1.0, private Message.content is stored without server-side sanitization and rendered as HTML in MessageShow.vue and view_message.html.twig. An authenticated low-privilege user, including a student, can send crafted message content to an administrator, which executes in the recipient's browser when the inbox or message view is opened.

In Chamilo LMS prior to 2.0.1, an unauthenticated remote attacker can execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism.

A SQL injection vulnerability exists in MailData Email Archiving System v4.2 and earlier. Technical details are not provided in the description.

The NetBox Device Type Library contains a deserialization vulnerability in its test harness, which loads pull-request-controlled pickle files. An unauthenticated contributor can supply a crafted pickle file, leading to arbitrary code execution when pytest runs in GitHub Actions or in a maintainer's process.

SAIL library version 0.9.10 and earlier contains a mode/depth mismatch when loading Bitmap-mode PSD files. psd_private_sail_pixel_format() returns a one-bit format while the loader accepts depth 8, causing out-of-bounds heap writes that lead to memory corruption, crashes, or potential code execution.

SAIL library version 0.9.10 and earlier contains an incomplete fix for CVE-2026-40494 in the TGA_INDEXED_RLE path. The image buffer is allocated as one byte per pixel, but the loader derives a wider pixel size from an attacker-controlled bpp value, leading to out-of-bounds heap writes and memory corruption.

Obsidian Web MCP prior to 0.2.0 allows an unauthenticated remote attacker to obtain an authorization code without login and exchange it for the static VAULT_MCP_TOKEN. This grants full access to vault operations including read, write, search, move, and delete.

GravitLauncher prior to 5.7.12 allows an unauthenticated remote attacker to read arbitrary files from the LaunchServer file server by sending an HTTP request without a leading slash. This exposes signing keys, refresh-token material, and database credentials.

Anyquery prior to 0.4.5 allows authenticated users with INSERT or UPDATE access to macOS virtual tables to execute operating-system commands. The Chrome, Brave, Edge, and Safari plugins interpolate a SQL-controlled URL into AppleScript or JXA source passed to osascript.

Many Notes prior to 0.16.0 allows an authenticated user to write arbitrary files outside their own vault during ZIP vault import. Through parent-directory traversal segments in filenames, an attacker can overwrite other users' files and place malicious SVG content leading to stored XSS.

In the Linux kernel, xfrm_dev_direct_output() frees the skb when local_out() returns a value other than 1, even though the skb has already been consumed or its ownership transferred. This causes a double-free when netfilter drops the packet.

In the Linux kernel, the IB/isert function isert_recv_done() passed received PDUs to opcode handlers without checking wc->byte_len, the number of bytes actually placed in the receive descriptor. An initiator could declare a larger data segment in the BHS header than it actually sent, leading to an out-of-bounds read, and in the imm_data_len path also to writing excess heap contents through the backend to the backing store.