CVE Vulnerability Catalog

A vulnerability in OpenStack Ironic before version 37.0.1 allows unauthorized creation or modification of nodes across projects. Lack of proper authorization enables an attacker to manipulate resources without required permissions.

A vulnerability in zhayujie CowAgent up to version 2.1.0 affects the BrowserTool._do_navigate function in agent/tools/browser/browser_tool.py. Input manipulation leads to information disclosure. The attack can be performed remotely and the exploit has been made public.

The WPCafe plugin for WordPress up to version 3.0.14 inclusive contains an authorization bypass vulnerability. Authenticated attackers with subscriber-level access or higher can manage notification workflows intended only for administrators.

The WP Hotel Booking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'check_in_date' and 'check_out_date' parameters in all versions up to and including 2.3.1 due to insufficient input sanitization and output escaping.

A vulnerability was found in Sipeed PicoClaw up to version 0.2.9, involving missing authorization in the rt.ReloadConfig function of the pkg/channels/pico/pico.go file. Manipulating the message.send argument allows remote exploitation. The exploit is publicly available.

A weakness has been identified in the MQTT Channel Handler component of Sipeed PicoClaw up to version 0.2.9, involving incorrect authorization via manipulation of the client_id argument in pkg/channels/mqtt/mqtt.go. The attack can be performed remotely and the exploit has been made public.

A server-side request forgery (SSRF) vulnerability has been discovered in the Guarded Web Fetch Flow component of Sipeed PicoClaw up to version 0.2.9, specifically in the WebFetchTool.Execute function in pkg/tools/integration/web.go. The flaw allows remote attackers to manipulate requests, potentially accessing internal resources. The exploit is publicly available and may be used in attacks.

In Vim prior to version 9.2.0725, the spell_soundfold_sal() function in src/spell.c has a stack buffer overflow vulnerability. When translating a word through spell file SAL sound-folding rules, insufficient length checking can cause a one-byte write past the end of the buffer, potentially corrupting the stack frame and crashing the editor.

A vulnerability in SiYuan before version 3.7.1 allows an authenticated administrator or API-token user to copy sensitive credential files (e.g., .git-credentials, .netrc, .pgpass) into the workspace and exfiltrate them via the file API. The issue stems from insufficient path filtering in the util.IsSensitivePath function.

A vulnerability in SiYuan prior to version 3.7.1 allows a Reader user in publish mode to read private document paths, notebook, document, and block IDs, as well as search and replace keywords for unpublished documents. The issue is due to missing publish-access filtering on the /api/storage/getCriteria endpoint.

A vulnerability in GitHub CLI (gh) from version 2.10.0 through 2.95.0 allows arbitrary command execution when connecting to a malicious Codespace using the `gh codespace jupyter` command. The command opens a JupyterLab URL supplied by a process inside the Codespace without validating that it is a loopback HTTP or HTTPS address, allowing a crafted `vscode://` or `vscode-insiders://` URL to be handed to VS Code.

In New API, an LLM gateway and AI asset management system, a vulnerability was found where the email and WeChat account binding endpoints use GET requests for state-changing operations. An attacker can exploit this to hijack a logged-in user's account by tricking their browser into binding an attacker-controlled email or OAuth identity when session cookies are sent on cross-site navigations.

In Discourse prior to versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, post revisions hidden from regular users could be leaked through visible diffs on adjacent revisions serialized by PostRevisionSerializer.

Cotonti Siena 0.9.26 and earlier contains a stored cross-site scripting vulnerability that allows authenticated users with PFS access to inject arbitrary script payloads by supplying malicious HTML in the ntitle parameter processed through the TXT filter in pfs.main.php. Attackers can create a folder with a crafted title containing script tags that are stored unescaped in the database and execute in the browser of any user who views the folder listing, including administrators.

A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering and access downstream resources that should be unreachable. A specifically formatted URL request is forwarded despite the system being configured to block it.

An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on EX Series devices allows an authenticated attacker with low privileges to cause a Denial-of-Service (DoS) by subscribing to an unsupported telemetry sensor path via gRPC, leading to an FPC crash and service outage until automatic restart.

An Improper Check for Unusual or Exceptional Conditions vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on MX Series allows adjacent subscribers to bypass configured firewall filters.

A race condition vulnerability in the packet forwarding engine (PFE) of Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause a Denial-of-Service (DoS). The flaw affects flow timeout handling, leading to session accumulation and potential system crash or reboot.

A missing synchronization vulnerability in the sFlow collector handler of Junos OS Evolved on QFX Series allows an unauthenticated adjacent attacker to cause a Denial-of-Service (DoS). When the reachability of an sFlow collector changes and the sFlow thread simultaneously accesses next-hop data, the evo-pfemand process crashes, blocking traffic forwarding until automatic restart.

A missing release of memory after effective lifetime vulnerability in the packet forwarding engine (PFE) of Juniper Networks Junos OS on EX4100 and EX4400 switches allows an unauthenticated adjacent attacker to cause an FPC crash and restart. The issue occurs when sFlow is configured in a Virtual Chassis scenario and multicast traffic is forwarded between VC members.