CVE Vulnerability Catalog

Dokploy before version 0.29.13 has a vulnerability in the WebSocket handler, where session validation does not authorize access to the requested server. An authenticated user can connect to a terminal on the Dokploy host without the required organization role or server-access check.

Flowise versions 2.2.4 through 3.1.4 have a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint, which is in the global authentication whitelist. An unauthenticated attacker can access private files from any chatflow, including those from other organizations.

GIMP's file format plugins, including those for PSD and PAA files, contain a vulnerability that a remote attacker can exploit by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts.

Dokploy from version 0.28.7 to 0.29.13 has a vulnerability in the server.remove tRPC mutation, which does not verify that the server's organization ID matches the session's active organization. An authenticated owner or administrator with server:delete in one organization can delete another organization's server and deployment records and receive the associated plaintext SSH private key.

Pega Platform versions 8.5.0 through 25.1.2 have an improper validation of cryptographic signatures issue, which may allow an attacker to bypass security controls.

Discourse has an SQL injection vulnerability in the Data Explorer plugin, allowing arbitrary SQL execution via query parameters, even by unprivileged users.

Discourse has a stored XSS vulnerability in the rich text editor, where a chat-transcript username is rendered as HTML.

In multicluster-global-hub, the manager improperly validates the source identity of incoming CloudEvents on Kafka status topics, allowing a remote attacker to falsify or delete data.

goose before version 1.44.0 has a vulnerability where the `goose review` command runs `git` without sanitizing configuration, allowing a malicious repository to execute arbitrary commands on the host.

SPIP before version 4.4.18 has a code injection vulnerability in SQLite-backed installations, allowing an authenticated attacker with editor privileges to execute arbitrary OS commands.

XWiki Platform has a vulnerability that allows discovering user password hashes bit by bit via modified LiveTableResults parameters, even after a previous patch.

Roskus Prospero Flow CRM before version 5.4.8 has an authorization bypass vulnerability in the contact management component, allowing authenticated users to overwrite contact data of other companies and download their personal data as vCard.

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification.

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed.

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim.

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset.

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601 through 20.07.2026.

In the Linux kernel, the gpu: host1x subsystem has a use-after-free vulnerability in host1x_bo_clear_cached_mappings. The __host1x_bo_unpin() function drops the last reference to the mapping and frees it, making later dereference invalid. The fix uses the local cache variable instead.

In the Linux kernel, the IB/mad subsystem has a vulnerability that allows processing unsolicited RMPP responses before they are matched to an outstanding request. This can lead to allocation or extension of RMPP state for responses that do not correspond to any sent request. The fix requires that for kernel-handled RMPP DATA responses, a match via ib_find_send_mad() must exist before entering RMPP reassembly.