CVE Vulnerability Catalog

LobeChat through version 2.2.9 with server-database deployments is vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS, and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibling methods apply, and findMessagePlugin reads back by id alone. An authenticated user who knows another user's message identifier can overwrite that victim's plugin tool-call metadata, plugin state/error, text-to-speech, and translation records on the same instance, and the tampered content is served back to the victim.

An XSS vulnerability in RAGFlow before 0.26.3 allows an authenticated user to inject arbitrary JavaScript via the agent pipeline (DSL) node name. The code executes in the session of another workspace member who opens the dataflow result and clicks the rerun button.

LobeChat before version 2.2.10-canary.15 contains a regular expression denial of service (ReDoS) vulnerability. An authenticated attacker can block the Node.js event loop by supplying a catastrophic-backtracking pattern in a GitHub repository URL path during skill import. The attacker crafts a malicious basePath value containing unescaped regex metacharacters, which are injected into a dynamically constructed regular expression in the findSkillMd function and executed synchronously against archive entries, denying service to all concurrent users for tens of seconds per request.

A double-free vulnerability was found in GIMP's PSP file format parser in the read_layer_block() function. This flaw can lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

Reflected XSS vulnerability in Netdata before 2.3.1 in the api/v2/ilove.svg and api/v3/ilove.svg endpoints. An attacker can inject malicious JavaScript via the love parameter, which is reflected in the SVG response without proper encoding. The endpoints are accessible without authentication, allowing remote script execution in the victim's browser.

TOCTOU race condition in the ssl module (dtls_packet_demux) in Erlang/OTP. An unauthenticated remote attacker can send multiple ClientHello messages from the same source, causing a race and crash of the demux process, terminating all active DTLS sessions on that listener. The attack is repeatable and requires no authentication.

Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window, enabling source address verification bypass. On DTLS server startup, dtls_server_connection:initial_hello/3 initializes previous_cookie_secret to the empty binary instead of a random value. Because HMAC with an empty key is deterministic, anyone who observes the plaintext ClientHello can compute a valid DTLS cookie before the first rotation of the cookie secret.

An infinite loop vulnerability in the ssh_sftpd module of Erlang/OTP SSH allows an authenticated SFTP user to permanently block an SFTP channel. By sending extended data (SSH_MSG_CHANNEL_EXTENDED_DATA) with a non-zero type code, the attacker causes the handle_data/4 function to loop indefinitely, preventing further message processing on that channel.

A vulnerability in the ssh_sftpd module of the SSH server in OTP (Erlang) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The issue stems from improper path handling in the SSH_FXP_REALPATH handler, which does not canonicalize the path before checking restrictions.

Craft CMS versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination folder without the required delete permission. The vulnerability is in the actionMoveFolder() function of the AssetsController.

A NULL pointer dereference vulnerability in the `GFAC_Sys_x64.sys` driver of Little Orbit GFAC allows a local attacker to cause a denial of service via crafted requests that trigger a system crash.

PraisonAI before version 0.1.7 fails to validate that the project_id in issue create and update request bodies belongs to the URL workspace. An attacker can create issues referencing projects from other workspaces, causing cross-tenant data pollution in project statistics aggregation without workspace constraints.

A stored Cross-Site Scripting (XSS) vulnerability has been found in TR7 Cyber Defense Inc. WAF-ASP due to improper input neutralization during web page generation. The issue affects versions from v1.0.324.900 before v1.4.0.117.

A DOM-Based XSS vulnerability was found in TR7 Cyber Defense Inc. Web Application Firewall due to improper input neutralization during page generation. It affects versions from 1.0.42.239 before 1.4.0.117.

The Surbma | Yoast SEO Breadcrumb Shortcode plugin version 1.2 and earlier contains a Contributor Cross Site Scripting (XSS) vulnerability. It allows an attacker to inject malicious JavaScript code into the page.

The Structured Content plugin version 1.7.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in the Contributor function. This allows an attacker to inject malicious JavaScript code into the page.

The Simple URLs plugin for WordPress version 151 and earlier contains a Stored Cross Site Scripting (XSS) vulnerability. An author can inject a malicious script that will be executed in the browser of an administrator or other user.

The Sendcloud Shipping plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.0.29.

The Mosaic Gallery – Advanced Gallery plugin version 1.2.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in the Contributor function. It allows an attacker to inject malicious JavaScript code into the page.

The Livemesh Addons for WPBakery Page Builder plugin version 3.9.4 and earlier contains a Cross Site Scripting (XSS) vulnerability in the Contributor functionality. This allows an attacker to inject malicious JavaScript code into the page.