CVE Vulnerability Catalog

Stored XSS vulnerability in CtrlPanel billing software (versions 1.1.1 and earlier) exists in ticket reply notifications. Unsanitized reply content is stored in the database and rendered unescaped via Blade's {!! !!} syntax, allowing arbitrary JavaScript execution in the victim's session context. Affects both admin and user notifications.

Innoshop 0.6.0 has an authorization vulnerability. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations.

In libheif versions up to 1.21.2, a heap buffer over-read exists in HeifPixelImage::overlay(). When compositing an overlay image whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride instead of the alpha stride, causing reads past the end of the alpha buffer.

libheif versions 1.21.2 and below have a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file with a mask image, the copy length is attacker-controlled and may exceed the destination buffer size.

libheif is a library for decoding and encoding HEIF and AVIF formats. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in grid tile compositing. An attacker can supply a HEIF/AVIF file with a 1×4 grid of odd-height tiles, causing a write of 64 attacker-controlled bytes past the end of allocated memory.

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kubernetes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris x64, Solaris Sparc 64 allows Privilege Escalation and Target Programs with Elevated Privileges. This issue affects Automic Automation versions prior to 24.4.4 HF1.

The Kirki plugin for WordPress up to version 6.0.6 is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function. Unauthenticated attackers can read and delete arbitrary files in the WordPress uploads directory.

A CSRF vulnerability in ScadaBR version 1.2.0 allows an attacker to lure a logged-in user to a malicious webpage, triggering any authenticated action in the victim's session.

A Java deserialization vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE). An attacker can supply crafted data that, upon deserialization, executes arbitrary code on the target system.

Windmill prior to version 1.703.2 has an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions. This allows authenticated users to write arbitrary entries to /etc/hosts, /etc/resolv.conf, and /etc/ssl/certs/ca-certificates.crt from within script execution sandboxes.

Kitty terminal versions 0.46.2 and below have a heap buffer overflow in load_image_data(). Any process that can write to the terminal's stdin can send a crafted APC command with a PNG declaration exceeding twice the initial buffer capacity, causing an immediate crash and potentially remote code execution.

Terrascan v1.18.3 and prior are vulnerable to SSRF via external URL resolution in uploaded IaC templates when running in server mode. An unauthenticated attacker can upload a template with a field pointing to a controlled URL, causing server-side fetch. Local file read via file:// scheme is also possible.

Terrascan v1.18.3 and prior are vulnerable to SSRF via the remote_url parameter in the remote directory scan endpoint in server mode. An unauthenticated attacker can supply an HTTP URL passed to go-getter without validation. Go-getter supports X-Terraform-Get header for redirect to file:// URL, enabling local file read. Additionally, ~/.netrc is read, potentially leaking credentials.

Terrascan v1.18.3 and prior are vulnerable to SSRF via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) in server mode. An unauthenticated attacker can supply an arbitrary URL, and Terrascan sends scan results with the webhook token to that URL.

A command injection vulnerability in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to v7.7 allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter.

An improper authentication vulnerability in the Motorola Factory Test component (com.motorola.motocit) allows third-party apps to open a TCP server via a writable file descriptor, exposing sensitive permissions and data.

BillaBear (all versions prior to Jan 2026) has a SQL Injection vulnerability in EventRepository. Metric filter names and aggregation properties are directly interpolated into SQL queries via sprintf() without sanitization. An authenticated attacker with ROLE_ACCOUNT_MANAGER can execute arbitrary SQL commands.

NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.