CVE Vulnerability Catalog

The GET /json/cfg endpoint in WLED calls serveJson without a settings-PIN check, unlike the /edit endpoint which checks correctPIN. This allows any unauthenticated client on the network to read the device's general configuration (network, hardware, LED setup).

dr_libs dr_wav.h contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly.

ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because [operator] binds tighter than [operator], any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to [function] (git supports file:// natively).

In libkcapi, the one-shot AIO path can return an error before all IOCBs are drained, allowing the kernel to later write into caller-owned output buffers, causing memory corruption.

In @oblique/cli 15.4.0, an OS command injection vulnerability exists in the project creation functionality. The project name is concatenated into a shell command without proper neutralization, allowing execution of additional commands.

nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter.

In the Linux kernel, the RDMA/rxe subsystem has a use-after-free vulnerability in rxe_mmap. The issue arises because the rxe_mmap_info structure is removed from the pending_mmaps list and the lock is released before remap_vmalloc_range completes, allowing a concurrent DESTROY_CQ ioctl to free memory during mapping. This can lead to a kernel crash (GPF) or a page-level use-after-free.

In Eclipse Theia up to 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints without confining to the workspace. In browser mode, the connection token is not enforced for HTTP requests, allowing unauthenticated clients to read any file readable by the backend process.

In Eclipse Mojarra versions 2.3 and later, URL handling in DefaultFaceletFactory does not block remote URLs, allowing an attacker to include a remote Facelet processed with server privileges.

Vulnerability in the wp-downloadmanager WordPress plugin (version 1.68.11 and 6.9.4 release line) allows an admin-privileged user to upload arbitrary files without any extension or MIME-type validation.

In toner-management, admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views.

The 'backmeup' npm package assembles shell command strings by directly concatenating option values and executes them via a shell, instead of using execFile/spawn with an argument array. This allows shell command injection.

Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID.

In Book-Management-System, Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication.

DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py, email_creators.py, and helpers.py.

Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &amp;lt;, &amp;gt;, and &amp;amp; back to <, >, and & immediately after purification.

Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side. The Lua engine performs no input validation and preloads dangerous libraries enabling arbitrary code execution, DB access, file I/O, SSRF, and path traversal.

Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value.

InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization.

MacCMS10's admin template editor blocks dangerous PHP functions via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log.