CVE Vulnerability Catalog

Discourse has a stored XSS vulnerability in the rich text editor, where a chat-transcript username is rendered as HTML.

In multicluster-global-hub, the manager improperly validates the source identity of incoming CloudEvents on Kafka status topics, allowing a remote attacker to falsify or delete data.

goose before version 1.44.0 has a vulnerability where the `goose review` command runs `git` without sanitizing configuration, allowing a malicious repository to execute arbitrary commands on the host.

SPIP before version 4.4.18 has a code injection vulnerability in SQLite-backed installations, allowing an authenticated attacker with editor privileges to execute arbitrary OS commands.

XWiki Platform has a vulnerability that allows discovering user password hashes bit by bit via modified LiveTableResults parameters, even after a previous patch.

Roskus Prospero Flow CRM before version 5.4.8 has an authorization bypass vulnerability in the contact management component, allowing authenticated users to overwrite contact data of other companies and download their personal data as vCard.

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification.

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed.

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim.

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset.

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601 through 20.07.2026.

In the Linux kernel, the gpu: host1x subsystem has a use-after-free vulnerability in host1x_bo_clear_cached_mappings. The __host1x_bo_unpin() function drops the last reference to the mapping and frees it, making later dereference invalid. The fix uses the local cache variable instead.

In the Linux kernel, the IB/mad subsystem has a vulnerability that allows processing unsolicited RMPP responses before they are matched to an outstanding request. This can lead to allocation or extension of RMPP state for responses that do not correspond to any sent request. The fix requires that for kernel-handled RMPP DATA responses, a match via ib_find_send_mad() must exist before entering RMPP reassembly.

A vulnerability in the Linux kernel's XFRM subsystem allows a stack-out-of-bounds read in xfrm_state_find() due to optional IPTFS templates in outbound policies not being covered by a previous fix. A local attacker can trigger a kernel panic by sending a crafted ICMP packet. The issue affects outbound policies only; IN and FWD policies are not vulnerable.

In the Linux kernel, a vulnerability in the RDMA/irdma driver allows a user to invoke rereg_mr on special memory regions (used for QP/CQ/SRQ creation) that lack a valid mkey. This triggers a real CQP command with a zero mkey, potentially causing incorrect behavior.

In the Linux kernel, the RDMA/siw driver's siw_create_qp() function calls siw_qp_add() before the QP is fully initialized, allowing other components to access a partially constructed QP. The fix moves siw_qp_add() to the end of the function after full initialization.

A vulnerability in the Linux kernel XFRM/IPsec subsystem was found. After a failed IPTFS state setup, the mode callback pointer (mode_cbs) remains in a dead state, which after module unload leads to a dangling pointer dereference by deferred GC (xfrm_state_gc_task) and a kernel panic.

A vulnerability in the Linux kernel's cfg80211 subsystem allows the sched_scan_res_wk work item to run after device unregistration, leading to a use-after-free condition. The issue is caused by missing cancellation of this work during wiphy unregister.

In the Linux kernel, the wifi mac80211 subsystem has a synchronization issue when removing an MLO link. sta_remove_link() frees the RX stats percpu buffer immediately, while the link container is freed only after RCU. This can lead to use-after-free in the fast RX path. The fix defers the percpu buffer free to an RCU callback.