CVE Vulnerability Catalog

The dashboards-observability plugin in OpenSearch Dashboards has an improper input validation vulnerability. A remote authenticated user with write permissions to saved objects can execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.

kin-openapi versions 0.124.0 through 0.142.0 have a DoS vulnerability. The sliceMapToSlice function converts attacker-controlled indexes from a deepObject parameter into a dense slice, which can lead to multi-gigabyte heap allocation and cause OOM kill or restart loop.

GNU Emacs before 31.0.91 has an integer overflow in the PBM/PPM/PGM image loader. An attacker can supply a crafted image with large dimensions and an elevated max color index, leading to heap memory content leakage.

kin-openapi versions 0.10.0 through 0.141.0 have a DoS vulnerability. The convertParseError function dereferences e.Parameter without checking if it is nil, which can lead to application panic when processing validation errors.

Hydra before version 1.3.4 has an arbitrary code execution vulnerability. The hydra.utils.instantiate() function resolves and calls Python objects selected by configuration, allowing an attacker to invoke dangerous callables.

Atlantis versions 0.19.8 through 0.45.0 do not consistently validate user-controlled workspace values. This can allow escaping the intended workspace directory and performing filesystem operations outside it, leading to integrity loss or DoS.

Keystone, a content management system for Node.js, prior to version 6.5.3, contains a vulnerability in the findMany resolver that allows a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.

YOURLS, a self-hosted, customizable URL shortener written in PHP, from version 1.5.1 until 1.10.4 stores the HTTP Referer header and aggregates it in statistics, then passes it to the chart builder which concatenates labels into inline JavaScript without proper escaping. This allows an unauthenticated attacker to poison the statistics of an existing short URL with a crafted referrer, leading to execution of malicious JavaScript in the YOURLS origin when an administrator or public stats-page viewer opens the affected page. This issue is fixed in version 1.10.4.

Microsoft UFO, an open-source framework for intelligent automation, prior to version 3.0.8, contains an MCP server on localhost:8010 that does not validate Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas, and invoke execute_command with a valid UFO_MCP_API_KEY, allowing reading files or executing allowed OS commands as the victim's user. This issue is fixed in version 3.0.8.

Defuddle, an HTML page cleaner, prior to version 0.19.1, contains a vulnerability in site extractors that interpolate page-derived values (such as image alt and src, og:image, video descriptions) into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without DOM-based sanitization. A malicious page or attacker-controlled content can inject event-handler attributes or javascript URLs that execute when the extracted HTML is rendered. This issue is fixed in version 0.19.1.

TensorZero, an open-source LLMOps platform, prior to version 2026.6.0, contains a vulnerability in the /internal/object_storage endpoint that accepts a caller-supplied storage_path parameter, dynamically overriding the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound requests to attacker-chosen endpoints, including internal or cloud-metadata. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment. This issue is fixed in version 2026.6.0.

LibVNCClient, a library for easy implementation of a VNC client, in versions 0.9.12 through 0.9.15, contains a vulnerability that allows a malicious (or man-in-the-middle) VNC server to force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It requires no authentication, works in a default build, and can crash the client or lead to code execution. The issue is patched in commit 540332be3e0acc566fa64da6f1b4680c72c724dd.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, there is a Reflected Cross-Site Scripting (XSS) vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3.

Joomla extension J2Store (versions 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5) is vulnerable to Stored Cross-Site Scripting (XSS) through the guest checkout billing address fields. An unauthenticated attacker exploits a filter bypass in Joomla's Input::getArray() combined with PHP's variables_order=EGPCS (Cookie overrides POST in $_REQUEST) to store unsanitized HTML in fields such as billing_first_name.

Joomla extension J2Store (versions 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5) allows an unauthenticated visitor to supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file() in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTP(S) values are treated as local filesystem paths, and file URI prefixes are removed, so a bare UNC path or file URI targeting an attacker-controlled share causes Windows to initiate an outbound SMB connection. This can expose NTLM authentication material to the attacker-selected host. This issue is fixed in version 2.55.0.windows.4.