CVE Vulnerability Catalog

A flaw was found in Jastow that makes it vulnerable to Cross-Site Scripting (XSS) attacks. If a specific configuration combination allows unescaped characters in the URL with embedded Undertow and Jastow, the server may be exposed to improper input handling.

A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

The PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint in Ghostfolio fails to verify the Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16 where `DomainNameValidator` does not prohibit newlines in domain names. If an application uses such values in HTTP responses, header injection can occur, although Django itself is protected by `HttpResponse`.

An issue was discovered in Django 6.0 before 6.0.7 and 5.2 before 5.2.16. `django.contrib.gis.gdal.GDALRaster` over-reads its in-memory buffer when constructed from a bytes object, which can disclose adjacent memory or cause service degradation via a potential segmentation fault when the `vsi_buffer` property is accessed.

A heap-buffer-overflow vulnerability was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN.

A stored cross-site scripting (XSS) vulnerability was found in the web management interface of Digi PortServer TS, Digi One SP, Digi One SP IA, and Digi One IA devices. A remote, authenticated administrator can inject malicious script into system configuration fields, which then executes in the browser of any user viewing the affected pages.

This vulnerability allows an unauthenticated attacker to bypass authentication and gain access to restricted resources on the device.

In the Dhara flash translation layer disk driver (drivers/disk/ftl_dhara.c) in Zephyr v4.4.0, a NULL pointer dereference vulnerability exists. During FTL disk initialization, on a flash read error (e.g., uncorrectable ECC), the error code is written through a potentially NULL err pointer, causing a kernel panic and denial of service.

In Apache Airflow before 3.3.0, the REST API task-instance detail and list endpoints returned a deferred task's trigger kwargs without masking. When a deferred operator passed a secret (for example a provider API key) into its trigger, any authenticated user with DAG-scoped task-instance read access for that DAG could read that secret in clear text while the task was deferred.

Before Apache Airflow 3.3.0, a user authorized to read one DAG could disclose the source code of other DAGs co-located in the same source file. The `GET /api/v2/dagSources/{dag_id}` endpoint and the equivalent UI view returned the entire source file without redacting unauthorized DAGs, bypassing per-DAG read authorization.

A vulnerability in Apache Airflow exposed per-key secrets-backend overrides (environment variables) as config options that were not masked. An authenticated user with Config read permission could retrieve plaintext secrets-backend credentials (e.g., role_id, secret_id) from the Config API.

A bug in Apache Airflow's `/ui/dependencies` scheduling graph endpoint leaks Dag IDs through the `dep.source` and `dep.target` fields of trigger and sensor dependency entries. An authenticated UI user with read permission on some Dags can enumerate identifiers of other Dags they are not authorized to read. This is a residual gap in the fix for CVE-2026-28563, which filtered the top-level Dag key but not the trigger/sensor dependency fields.

A vulnerability in the Apache Airflow Bulk Variables API causes the redactor to not receive the variable key, so the `should_hide_value_for_key` check (triggered by secret-suffixed key names like `_password`, `_token`, `_secret`) does not apply to JSON-decodable variable values. An authenticated user with bulk Variable read permission can retrieve plaintext values from JSON variables whose key would otherwise trigger redaction.

The vulnerability in PcVue before version 17.0.0 is due to the use of an insufficiently strong encryption algorithm for protecting user account configuration in the built-in directory. A local attacker can alter the existing configuration and gain privileged access to the application.

In PcVue projects prior to version 17.0.0, credentials of built-in users are insecurely stored in the User directory. A local attacker could retrieve these credentials. Active Directory accounts are not affected by this vulnerability.

A vulnerability in the EEPROM firmware on Raspberry Pi 5 and Compute Module 5 devices produces non-random KASLR and RNG seed values. This results in consistent kernel addresses across boots and devices, potentially making it easier to exploit other vulnerabilities. Additionally, the low-quality RNG seed may affect the quality of random numbers or delay booting while sufficient entropy is accumulated from other sources.

A reflected XSS vulnerability was found in the Access Control System (GKS) by Armiya Information Technologies Ltd. Co. before version 2. The flaw is due to improper input neutralization during web page generation.

A stored Cross-Site Scripting (XSS) vulnerability exists in Armiya Information Technologies Ltd. Co. Access Control System (GKS) before version 2. The flaw is caused by improper neutralization of input during web page generation.

An XSS vulnerability in Armiya's Access Control System (GKS) allows an attacker to inject malicious scripts via HTML attributes. The issue affects versions prior to 2.0.