CVE Vulnerability Catalog

Snipe-IT prior to version 8.6.2 has a vulnerability in the POST /api/v1/kits/{kit_id}/licenses endpoint, allowing a low-privilege user to bind a license to a kit without proper authorization. Access to the license object is not validated, enabling unauthorized license association.

Snipe-IT prior to version 8.6.0 has a vulnerability in the POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} endpoint, where the cancel_by_admin parameter is accepted without proper authorization. An authenticated user can supply a victim user ID and silently cancel that user's pending asset requests.

In Snipe-IT prior to version 8.5.0, the displaySig method in ActionlogController lacks sanitization of the filename parameter, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process.

In Snipe-IT prior to 8.6.2, with Full Multiple Companies Support and scope_locations_fmcs enabled, the API location creation endpoint detects a parent-child company mismatch but does not abort, allowing creation of a child location under a parent from a different company.

Snipe-IT prior to 8.6.2 did not sanitize javascript: URIs in Markdown hyperlinks, allowing a user with assets.edit permission to place a malicious link in a markdown-textarea custom field. When another user opens the asset detail page and clicks the link, arbitrary JavaScript executes.

In Coturn prior to version 4.13.0, the 'psd print sessions dump' CLI command takes a filename argument and passes it directly to fopen without path validation. An authenticated admin with CLI access can overwrite arbitrary files writable by the Coturn process using session dump data.

GNU Wget does not validate the IP address provided by an FTP PASV response while operating in FTP passive mode. A malicious FTP server or an HTTP server redirecting to an FTP URL can exploit this behavior to redirect Wget's data connection to an arbitrary IP address and port.

HestiaCP before version 1.9.5 has a stored cross-site scripting vulnerability. Authenticated low-privilege users can inject arbitrary HTML/JavaScript by creating a DNS record with a double quote and script payload in the value field. The application fails to encode the value with htmlspecialchars() in list_dns_rec.php, allowing the payload to execute in browsers of other users, including administrators.

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the RAG corpus. On 2026-03-25, network access was restricted and authentication was enforced for the previously exposed endpoints.

Deloitte AI Assist for Customer accepted unauthenticated POST requests through public API endpoints, allowing a remote attacker to make limited configuration changes. These changes were not used by the system. Since 2026-03-25, network access has been restricted and authentication enforced.

Deloitte AI Assist for Customer exposed configuration information through public API endpoints that accepted unauthenticated requests. This information could reduce an attacker's reconnaissance effort. As of 2026-03-25, network access was restricted and authentication enforced.

In ZITADEL prior to version 4.15.3, the external identity provider handler checks that the local user's email is verified but does not verify that the external IdP confirmed ownership of the same email before auto-linking by email. This allows a permissive provider account with a victim email address to be linked to the victim's local account.

A vulnerability in ZITADEL (versions 3.0.0-rc.1 through 3.4.11 and 4.0.0-rc.1 through 4.15.1) causes external JWT validation to skip expiration handling when the token lacks the exp claim. A token from a trusted issuer is treated as valid without an automatic expiration window.

In ZITADEL prior to versions 3.4.12 and 4.15.2, the external JWT Identity Provider validation skips the maximum token age freshness check when an incoming token omits the iat claim, allowing arbitrarily old tokens from a trusted issuer to pass authentication.

A vulnerability in Grav prior to version 2.0.0 allows an authenticated admin.super user to crash the system or fill the disk by uploading a specially crafted ZIP archive via the Direct Install tool. The issue stems from the unZip function lacking limits on uncompressed size, entry count, or directory depth.

In Wekan prior to version 9.64, a cross-board authorization bypass vulnerability exists in the direct Meteor collection allow rules for Checklists and ChecklistItems. An authenticated low-privileged user with write access to one board and knowledge of a target private card ID can create checklist data on an accessible card and move it into a private board where they are not a member.

The database plugin for Grav CMS prior to version 1.2.0 contains a vulnerability due to unsafe construction of PDO DSN strings. The Database::__call method directly concatenates user-configurable YAML values (such as host, dbname, charset, server, database, directory, filename) without sanitization or validation, allowing an administrator with plugin configuration access to inject DSN attributes or path traversal values.

PeerTube before version 8.2.2 contains a server-side cross-site scripting (XSS) vulnerability in video watch pages. When generating a schema.org JSON-LD block, video metadata is stringified without escaping special characters, allowing an attacker to inject arbitrary HTML or JavaScript.

Grav prior to 2.0.0-rc.9 contains a stored XSS vulnerability via the Markdown image style attribute. The incomplete fix for CVE-2026-42841 leaves the MediaObjectTrait::style method reachable through the same excerpt-action pipeline, allowing an editor to save unsanitized image style parameters.

A vulnerability in Grav allows an authenticated administrator with backup permissions to download a ZIP archive containing the full Grav installation root, including user/accounts/admin.yaml with the administrator password hash and user/config with site configuration. The issue is fixed in version 1.7.53.