CVE Vulnerability Catalog

Stored XSS vulnerability in SOPlanning version 1.55 and below. An authenticated attacker can upload a crafted ZIP archive with a malicious user.csv file containing JavaScript, which executes when a user clicks the Edit button.

An SQL injection vulnerability was discovered in itsourcecode Content Management System 1.0. The issue affects the /instructions.php file where the topic_id argument is not properly sanitized. Remote attack is possible and the exploit is publicly available.

In jeecgboot up to version 3.9.1, a server-side request forgery vulnerability exists in the FileDownloadUtils.download2DiskFromNet function of /airag/app/debug. The attack can be performed remotely and the exploit has been released. Version 3.9.2 fixes the issue.

In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in an unknown function of /airag/airagModel/test. Manipulation of the baseUrl argument allows remote attack. The exploit is publicly available.

In JeecgBoot up to version 3.9.2, a server-side request forgery vulnerability exists in the WordUtil.addImage function of /airag/word/edit. The attack can be performed remotely and the exploit has been publicly disclosed.

SourceCodester Water Billing Management System 1.0 has an SQL injection vulnerability in /admin/?page=user/manage_user via the ID argument.

A bug in the GET `/api/v2/connections/{connection_id}` REST API endpoint in Apache Airflow allows an authenticated user with Connection-read permission to retrieve secrets stored in a Connection's `extra` JSON blob under field names not in the redaction allowlist. Affects deployments storing credentials in `extra` blobs and granting Connection-read access to multiple users.

A SQL injection vulnerability was found in CodeAstro Ingredients Stock Management System 1.0 in the file /Ingredients-Stock/stock_manager.php via the txt_search_category argument. The attack can be performed remotely, and the exploit is publicly available.

In Assimp up to version 6.0.4, a vulnerability was found in the function aiNode::~aiNode in file scene.cpp of the ASE File Parser component. Manipulation can lead to use-after-free. The attack requires local access.

In Assimp up to version 6.0.4, a vulnerability was found in the function HL1MDLLoader::extract_anim_value in file HL1MDLLoader.cpp of the Half-Life 1 MDL Loader component. Manipulation of the num.total argument leads to a heap-based buffer overflow. The attack requires local access.

A heap-based buffer overflow in the function Assimp::MDL::HalfLife::HL1MDLLoader::read_animations in Assimp up to version 6.0.4 allows local attackers to cause a crash or potentially execute arbitrary code.

A heap-based buffer overflow in the function HL1MDLLoader::read_meshes in Assimp up to version 6.0.4 allows local attackers to cause a crash or potentially execute arbitrary code.

A vulnerability was detected in NousResearch hermes-agent up to version 2026.4.30. It affects the _handle_webhook_request function in the file gateway/platforms/feishu.py of the Webhook Endpoint component. Manipulation leads to resource consumption. The attack can be launched remotely. The exploit has been publicly disclosed.

A weakness was identified in NousResearch hermes-agent up to version 2026.4.30 in the function _scan_memory_content of file tools/memory_tool.py, allowing remote injection. The exploit has been made public and could be used for attacks. The vendor did not respond.

In NousResearch hermes-agent up to version 2026.4.30, an injection vulnerability exists in the _sanitize_env_lines function of hermes_cli/config.py. The attack can be launched remotely but requires high complexity. The exploit has been publicly released.

An improper neutralization of active SVG content in OTRS or ((OTRS)) Community Edition ticket article rendering allows attackers to inject specially crafted SVG payloads via email content, leading to browser-side resource exhaustion and denial of service when affected tickets are opened by an agent or customer. The issue can be exploited without JavaScript execution and is not mitigated by the configured Content Security Policy (CSP).

An improper input validation vulnerability in the OTRS Customer Backend module allows access to customer information restricted to other groups. This affects versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, but only when the CustomerGroupSupport feature is enabled.

An uncontrolled resource allocation vulnerability in OTRS email handling can lead to excessive resource consumption and webserver abortion. This affects versions 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.4.X, and likely also OTRS Community Edition 6.x and OTRS 7.x.

Vulnerability in the WLAN STA driver on Android (MediaTek chipset) allows a system crash due to a missing bounds check, leading to local denial of service.

In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10873936; Issue ID: MSV-6786.