CVE Vulnerability Catalog

Live Helper Chat is an open-source application that enables live support websites. In version 4.84v, the Live Helper Chat REST API chat update endpoint allows a REST user with lhchat/use to update a chat in a department they cannot read.

SiYuan is a knowledge management system that in versions from 2.1.12 to before 3.7.0 renders package author metadata from the public bazaar feed into HTML without proper escaping. In the desktop app, this leads to stored XSS, allowing code execution on the host.

The Note Mark application, from version 0.13.0 to before 0.19.4, allows authenticated users to upload assets to notes without proper filename validation. The filename is stored in the database unsanitized, enabling an attacker to exploit directory traversal sequences.

Strapi is an open-source content management system that in versions from 4.0.0 to prior to 5.37.0 did not sufficiently sanitize query parameters when filtering content via relational fields. An unauthenticated attacker could use the `where` query parameter to perform a boolean-oracle attack against private fields in the `admin_users` table, allowing for administrative account takeover.

In Fleet software, prior to version 4.81.0, a vulnerability in the Windows MDM management endpoint could allow requests to be processed without proper client certificate validation. In certain circumstances, an attacker could impersonate an enrolled Windows device and retrieve sensitive configuration data.

In Strapi, versions 4.x prior to 4.26.1 and 5.x prior to 5.33.2, a database-query injection vulnerability existed in the Content-Type Builder write API. An authenticated administrator could inject arbitrary database statements through the `column.defaultTo` attribute when creating or modifying a content type.

CVE-2026-6332 vulnerability concerns the cleartext storage of sensitive information, which may lead to the disclosure of protected source code. An authorized attacker with access to the source code can edit or compile it.

Mongoose, a MongoDB object modeling tool, prior to versions 6.13.9, 7.8.9, 8.22.1, and 9.1.6 had a vulnerability that allowed bypassing the sanitizeFilter query sanitization mechanism via the $nor operator. This operator was not properly sanitized, allowing for the injection of malicious operators.

The Yordam Library Automation System has a code injection vulnerability that allows remote code inclusion. This issue affects versions from 19.5 to before 22.1.

The vulnerability related to incorrect authorization in the Yordam Library Automation System allows exploiting incorrectly configured access control security levels. It affects versions from 19.5 to before 22.1.

The Diffusers library prior to version 0.38.0 allows remote code execution without the trust_remote_code=True safeguard when loading pipelines from Hugging Face Hub repositories. The _resolve_custom_pipeline_and_cls function in pipeline_loading_utils.py performs string interpolation on the custom_pipeline parameter, which can lead to unauthorized code execution.

Valtimo is an open-source business process automation platform. From versions 12.4.0 to 12.33.0 and 13.26.0, the LoggingRestClientCustomizer in the web module automatically intercepts all outgoing HTTP calls and logs full request and response bodies, which may lead to sensitive information disclosure.

The Diffusers library before version 0.38.0 contains a vulnerability that bypasses the trust_remote_code protection. An attacker can execute arbitrary remote code even when trust_remote_code is set to False or omitted. The issue stems from a flawed implementation of the security check in the download() function, which can be bypassed through alternative code paths.

Katalyst Koi, a framework for building Rails admin functionality, had an issue where admin session cookies were not invalidated upon logout. An attacker with access to a valid admin session cookie could continue to access admin functionality after logout until the cookie expired or session secrets were rotated.

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, allows an unauthenticated, remote attacker to read arbitrary files stored on the affected system. The flaw is due to improper handling of XML External Entity (XXE) entries when parsing an XML file.

Aegra, a drop-in replacement for LangSmith Deployments, prior to version 0.9.7 was vulnerable to a cross-tenant IDOR. This allows an authenticated attacker with another user's thread_id to execute operations on that thread and access the user's full checkpoint state.

The RedirectHandler middleware in the microsoft/kiota-java library (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization header is removed; Cookie, Proxy-Authorization, and all custom headers are forwarded to the redirect target.

Gotenberg is a PDF file API that prior to version 8.32.0 lacked default protection against HTTP/HTTPS-based SSRF attacks. An attacker could point Chromium at any internal IP and receive a response rendered as a PDF.

Gotenberg, a PDF file API, has a vulnerability prior to version 8.32.0 that can lead to process crashes. The issue arises from improper context management during concurrent requests, causing a panic in the webhook goroutine.