CVE Vulnerability Catalog

FastGPT, an AI Agent building platform, prior to version 4.15.0-beta1 contains an SSRF vulnerability. An authenticated attacker can bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to internal network services by exploiting an incomplete fix in the dataset preview endpoint /api/core/dataset/file/getPreviewChunks when using the externalFile data import type.

In JetBrains TeamCity before version 2026.1, improper permission checks expose build configuration parameters. Users without proper permissions may access sensitive settings.

JetBrains TeamCity before version 2026.1 is vulnerable to remote code execution via Perforce connection settings. An attacker can exploit this to execute arbitrary code on the TeamCity server.

In JetBrains TeamCity before versions 2026.1 and 2025.11.5, unauthenticated server-side request forgery (SSRF) via build status is possible.

JetBrains TeamCity before version 2026.1.1 contains a reflected Cross-Site Scripting (XSS) vulnerability in the keyword filter. An attacker can inject malicious JavaScript code that executes in the victim's browser.

JetBrains YouTrack before version 2026.1.13162 allows stored XSS in project notification templates.

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account.

In JetBrains IntelliJ IDEA before 2026.1.1, command injection was possible via filename completion.

Shopper, a Headless e-commerce Admin Panel, prior to version 2.8.0 contains a vulnerability where multiple Filament actions on order details and shipment tables could be called by an authenticated low-privilege user without the required permission to mutate orders. Actions like cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission instead of the required edit_orders. capturePayment could trigger actual PSP capture (real funds movement). A user with read access could alter the lifecycle of every order and trigger real-world payment captures.

Vulnerability in SillyTavern before version 1.18.0. The /api/search/searxng endpoint accepts attacker-controlled baseUrl, enabling requests to internal or loopback HTTP services.

SillyTavern before version 1.18.0 uses cookie-session for authentication, storing session data in a signed cookie. Password change endpoints do not invalidate existing sessions, allowing an attacker with a stolen cookie to retain access after a password change.

The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.

The Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.

Stored XSS vulnerability in certain 1xxx series NVR devices due to insufficient input sanitization. Attackers can inject malicious scripts that are persistently stored and executed in the browsers of administrators or users.

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without pairing or authorization. Attackers within BLE range can take control, and the Frontier X app lacks device authentication, allowing impersonation and injection of fake health telemetry (e.g., heart rate, breathing rate).

Arcane to interfejs do zarządzania kontenerami Docker, obrazami, sieciami i wolumenami. W wersjach przed 1.19.4, metoda ProjectService.GetProjectFileContent zwracała zawartość dowolnej dyrektywy include z pliku compose projektu przed przeprowadzeniem walidacji ścieżek, co umożliwiało atakującemu odczytanie plików systemowych.

Arcane, an interface for managing Docker containers, before version 1.19.2 contains a vulnerability due to missing admin authorization check on the PUT /api/environments/{id}/templates/variables endpoint. Any authenticated non-admin user can overwrite global environment variables used across all projects.

Arcane to interfejs do zarządzania kontenerami Docker, obrazami, sieciami i wolumenami. W wersjach przed 1.19.0, nieautoryzowany endpoint GET /api/app-images/logo odzwierciedla parametr zapytania koloru dostarczony przez użytkownika w treści dokumentu SVG, co pozwala na wstrzyknięcie złośliwego kodu JavaScript.

Vulnerability in Klever-Go before version 1.7.17. A remote, unauthenticated denial-of-service vulnerability in Batch.Decompress allows any peer participating in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet can OOM-kill a validator.

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint. Attackers can read arbitrary files outside the intended music directory by exploiting an incomplete path prefix check.