CVE Vulnerability Catalog

In Easy Chat Server 3.1, a Directory Traversal vulnerability via the UserName parameter allows a remote attacker to obtain sensitive information and execute arbitrary code.

A Cross-Site Scripting (XSS) vulnerability was detected in Advantech WebAccess/SCADA 8.0-2015.08.16 in the Create New Project User component, in the decryption field. A remote attacker can obtain sensitive information.

Mattermost versions 11.6.0, 11.5.x up to 11.5.3, 11.4.x up to 11.4.4, and 10.11.x up to 10.11.14 fail to validate the OAuth token scope on the callback, allowing an authenticated user to gain access to private repositories by modifying the scope parameter in the GitHub authorization URL.

Typebot versions 3.15.2 and earlier have an IDOR vulnerability in the getResultLogs API endpoint. An authenticated attacker can read execution logs from other workspaces by supplying their own typebotId and a victim's resultId, leaking sensitive data.

Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier have missing authorization in the entry status management feature. An authenticated non-admin user can bypass the admin-enforced Pending Approval flow and access entry data via a crafted status change request.

Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve documentation and attachments of sealed entries via a crafted API request.

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This affects versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier.

Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted API request.

Missing authorization in the vault import feature in Devolutions Server up to version 2026.1.16.0 allows a low-privileged authenticated user to create new vaults via a crafted import request.

Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to retrieve that entry's activity logs via a crafted API request. Affects versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree. This can be leveraged to execute XSS attacks in applications that attempt to sanitize input HTML before rendering.

Parsing arbitrary HTML can consume excessive CPU time, leading to denial of service (DoS).

Dell Unisphere for PowerMax vApp versions prior to 10.0.0.2 contain an authorization bypass vulnerability in the Unisphere for VMAX application running in vApp.

Dell ECS versions 3.5 and 3.6 have an improper access control vulnerability in the Identity and Access Management (IAM) module. A remote unauthenticated attacker can gain read access to unauthorized data.

Concrete CMS versions 9.0 to 9.5.0 are vulnerable to Stored XSS via page name in the Atomik theme. A rogue editor can inject arbitrary JavaScript that executes in the context of any authenticated user visiting the affected account pages.

Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog. This can cause Cross-entity state tampering with view-only permission on one entry. To be affected, a website has to be using express and relying on express entity ordering.

Concrete CMS version 9.5.0 and below is vulnerable to CSRF via Backend\File::approveVersion. A victim with edit_file_contents permission can be tricked into publishing an attacker-chosen previously-uploaded file version (downgrade or activation of an unpublished version).