CVE Vulnerability Catalog

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a server-side request forgery (SSRF) vulnerability. An unauthenticated attacker can exploit the lack of destination validation and the default passphrase 'opendoor' to send blind HTTP requests to arbitrary internal or external hosts when the optional Node-RED plugin is installed.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability. Unauthenticated attackers can inject arbitrary JavaScript by supplying malicious payloads within program names submitted via HTTP requests.

Easy!Appointments up to version 1.5.2 embeds the entire customer record as inline JavaScript on the reschedule page without authentication or field whitelisting. Anyone with the 12-character appointment hash can read all columns of the customer record from the ea_users table.

An open redirect vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote unauthenticated attacker to redirect users to arbitrary external URLs.

In Zephyr RTOS, the CONFIG_USERSPACE verification handler for the k_thread_name_copy() system call calls k_object_find() on a user-supplied thread pointer and dereferences the returned struct without NULL check. If the pointer is not a registered kernel object, a NULL dereference occurs in supervisor mode, causing a system crash or reboot.

A denial-of-service vulnerability in the 1734 POINT I/O™ module arises from improper handling of crafted CIP messages, which can cause the module to enter a faulted state. Recovery requires a restart of the device.

Out-of-bounds read vulnerability in Citrix Secure Access Client for Windows. The issue affects versions prior to 26.6.1.20.

An improper authorization vulnerability in Apache Kylin allows an attacker to access unauthorized jobs in other projects during job information retrieval.

A Path Traversal vulnerability (CWE-22) was found in Apache OpenMeetings versions from 5.0.0 before 9.1.0. An attacker with moderator rights in any room can read arbitrary files accessible to the OS account running the OM server, including credentials and secrets, via a crafted download request.

A vulnerability in Firefox and Thunderbird with public exploit code but no known active attacks. Fixed in Firefox 152.0.6, Firefox ESR 115.38, Firefox ESR 140.13, and Thunderbird 140.13.

This vulnerability was fixed in Firefox 152.0.6, Firefox ESR 140.13, and Thunderbird 140.13. Exploit code is publicly available, but no attacks in the wild are known.

A vulnerability in TYPO3 CMS allows users to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.

A vulnerability in HX 10.0.0 and earlier versions allows an attacker with access to the HX console to send specially crafted data. The malicious detection triggers decompression of a large file, causing excessive system resource consumption and a Denial of Service (DoS).

The Academy LMS plugin for WordPress up to version 3.8.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the 'save_lesson_note', 'get_lesson_note', and 'complete_lesson_video' AJAX handlers due to missing validation on a user-controlled key. This allows authenticated attackers with Subscriber-level access or higher to read, overwrite, or delete private lesson notes of any other user (including administrators) and falsify lesson-completion progress for arbitrary users.

A privilege escalation vulnerability in Checkmk allows a local unprivileged user to execute arbitrary commands as root by starting a process crafted to look like a SAP HANA instance. The mk_sap_hana agent plugin, running as root, derives instance identifiers from the process list and uses them to build a command executed with elevated privileges.

The fix for CVE-2026-0716 in libsoup 3.6.6 (commit 6ff7ef0) placed the integer overflow guard only inside the masked frame block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0.

A vulnerability has been identified in Siemens COMOS, Designcenter NX, Simcenter, Solid Edge, Teamcenter Visualization, Tecnomatix Plant Simulation, and Tecnomatix Process Simulate products due to an untrusted search path in IAM Client SDK. It may allow an authenticated user to escalate privileges via local access.

In Eclipse Jetty, a vulnerability has been identified involving incorrect path resolution for URIs containing semicolons. A request to a resource like '/public;/../admin/secret.txt' results in Jetty returning an unresolved path '/public/../admin/secret.txt' instead of the expected '/admin/secret.txt'. Jetty itself is not vulnerable because it does not serve files that fail the alias check, but web applications relying on Jetty's path resolution may be confused.

In Eclipse Jetty for HTTP/1, HTTP/2, and HTTP/3 requests, there is no strict check that the request authority (host and port) matches the value provided in the Host header (if present). This mismatch can cause problems such as incorrect URI construction, virtual host selection, reverse proxying, misleading logs, and others.

A vulnerability in the Mint library for Elixir allows a remote HTTP/2 server to exhaust client memory by sending an infinite stream of zero-length CONTINUATION frames. The header accumulation mechanism lacks proper protection against this attack, leading to denial of service (DoS).