CVE Vulnerability Catalog

ZITADEL, an open source identity management platform, prior to versions 3.4.12 and 4.15.2 does not validate the audience (aud) claim in its external JWT Identity Provider. This allows a validly signed token from a trusted issuer intended for another relying party to be accepted by ZITADEL.

A stored Cross-Site Scripting (XSS) vulnerability was found in Webremium Istanbul Web Design Mezunum Satiyorum due to improper input neutralization during page generation. Affected versions range from 1.2.504 to 10072026.

A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/sendlogfile. An unknown functionality causes improper authorization, allowing remote attacks. The exploit has been publicly disclosed and may be used.

A vulnerability in Eleveo Call Recording Software 9.7.0 affects the file /callrec/statisticReportAction.do. An unknown function leads to improper authorization, allowing remote exploitation. The exploit is public, and the vendor did not respond.

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

A user with Editor permissions can craft a dashboard whose table (TableNG) panel contains a malicious field name that executes as a script in the browser of any user who views the dashboard (stored cross-site scripting).

In osquery prior to version 5.23.1, an unprivileged attacker can read the contents of files during an ongoing file carve because temporary directories are not created with private permissions. If the carve targets a directory controlled by the attacker, arbitrary file reads are possible, including sensitive local files.

A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/users_ldap.jsp of the LDAP User Interface component. An unknown function leads to improper authorization, exploitable remotely. The exploit has been publicly disclosed.

A flaw in Eleveo Call Recording Software 9.7.0 affects the file /callrec/roleAddAction.do in the Group Interface component. Manipulation can lead to improper authorization. The attack can be launched remotely and the exploit has been published.

A vulnerability was found in Eleveo Call Recording Software 9.7.0 in the file /callrec/userAddAction.do. An unknown function improperly authorizes the role argument, allowing unauthorized actions. The attack can be performed remotely and the exploit is publicly available.

The Grav API plugin before version 1.0.3 fails to sanitize SVG files uploaded via the POST /api/v1/media endpoint. The processUploadedFile() method only validates the file extension and does not call Security::sanitizeSVG(), allowing an authenticated attacker with api.media.write permission to upload an SVG containing arbitrary JavaScript. The file is stored unmodified and served with Content-Type: image/svg+xml; when an administrator opens it in a browser, the embedded script executes in their session context, enabling cookie theft and session hijacking.

Grav before version 2.0.1 contains a decompression bomb vulnerability in the ZipArchiver::extract() method, which lacks limits on uncompressed size, file count, and nesting depth. Attackers can supply a crafted ZIP archive that expands to fill available disk space, causing denial of service by exhausting storage resources.

Grav before version 2.0.2 contains a Twig sandbox bypass that allows a page author (any admin.pages user, or anyone able to write to user/pages) to exfiltrate configuration secrets. Although the sandbox replaces the 'config' variable with a redacted facade and strips Config::get/toArray from the method allowlist, the raw container remains accessible via the allow-listed grav.offsetGet('config'), which returns the real Config object. Allow-listed object-dumping filters (json_encode, print_r, yaml_encode) then serialize that object at the PHP level without invoking the sandbox method gate, exposing the full config tree including plugin secrets such as SMTP credentials, API keys, and plugin DB credentials.

A vulnerability in PraisonAI Platform before version 0.1.9 allows unauthorized deletion of issue dependencies. The authorization mechanism only checks permissions for the endpoint selected by the caller, enabling a workspace member to delete a dependency created by an owner by targeting a related member-owned issue endpoint.

A path traversal vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 in the FastContext feature. The FastContextAgent.execute_tool() function does not properly validate absolute paths or canonicalize relative paths, allowing reading, searching, and enumerating files outside the intended workspace directory.

PraisonAI before version 4.6.78 contains a path traversal vulnerability in the ContextGatherer component that fails to validate include paths in .praisoncontext and .praisoninclude files. Attackers can supply absolute paths or parent directory traversal sequences to read arbitrary files outside the workspace and include their contents in the generated context bundle.

A vulnerability in PraisonAI (praisonaiagents) before version 1.6.78 automatically loads defaults from a project-local .praisonai/config.toml without validating the output.output_file path. An attacker can set this path to an absolute or '..' traversal path, causing agent.start() without an output parameter to overwrite files outside the project root.

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the prompt injection defense mechanism. The defense only blocks threats classified as CRITICAL, requiring three or more detector families to match simultaneously. Attackers can craft single or double-vector prompt injections classified as HIGH threat level, which pass through unblocked to the model.

A vulnerability in n8n before version 2.28.0 (and before 1.123.58 on the 1.x branch) allows disk space exhaustion via the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary directory, enabling an authenticated user to repeatedly upload files that accumulate on disk until periodic cleanup runs.

A vulnerability in phpMyFAQ before version 4.1.5 allows unauthenticated attackers to retrieve inactive (draft or review-only) FAQ content due to inconsistent filtering in public API endpoints.