CVE Catalog

A stored cross-site scripting vulnerability has been identified in the Ad Hoc module of Progress MOVEit Transfer. This issue allows an authenticated attacker to send a message containing a crafted JavaScript payload, which is then executed in the browser of the message recipient. The vulnerability affects MOVEit Transfer versions 2026.0.0 prior to 2026.0.1, 2025.1.0 prior to 2025.1.4, 2025.0.0 prior to 2025.0.8, and 2024.1.8 and earlier.

A vulnerability in the Adalo database API allows authenticated users to access complete user records from any Adalo application, bypassing application-specific authorization controls. This issue arises from the API's failure to enforce ownership-aware, server-side authorization checks, combined with a permissive CORS policy and the exposure of long-lived JWT tokens. As a result, attackers can automate the extraction of sensitive personal information, including emails and custom fields, from over one million Adalo applications.

A vulnerability in Adalo's no-code app builder, affecting versions 1 and 2, allows authenticated users to extract full user records from the database API of any application on the platform. This issue arises from a lack of proper authorization checks, enabling the retrieval of complete user data, including unrequested fields, across more than one million applications. The vulnerability is exacerbated by a permissive CORS policy and the plaintext storage of text files, with evidence suggesting that deleted records may still be accessible.

A memory leak vulnerability has been identified in the SFTP service of Progress MOVEit Transfer, specifically within the Custom Reports modules. This issue affects MOVEit Transfer versions 2024.1.8 and earlier, 2025.0.0 prior to 2025.0.8, 2025.1.0 prior to 2025.1.4, and 2026.0.0 prior to 2026.0.1. The vulnerability arises from improper memory management, allowing for a gradual exhaustion of memory resources on the server. As a result, the vulnerability can cause a temporary denial-of-service condition, disrupting normal service operations.

A table scope bypass vulnerability has been identified in the Custom Reports module of Progress MOVEit Transfer. This vulnerability affects versions 2025.0.0 prior to 2025.0.8, 2025.1.0 prior to 2025.1.4, and 2026.0.0 prior to 2026.0.1. The issue allows a high-privilege attacker to execute a custom report that could expose API tokens belonging to other MOVEit users in the system.

A vulnerability in MISP allows an authenticated user to access restricted import module functionality, potentially leading to unauthorized import or modification of event data. This issue arises because the importModule() function did not properly enforce per-organization module restrictions. As a result, users from organizations not allowed to use certain modules could still invoke them directly if they knew the module names. The vulnerability affects MISP versions prior to the patch included in commit 0ed79b4.

An authorization bypass vulnerability has been identified in MISP's EventsController import module. This issue allows authenticated users or read-only API keys with event view access to persist data to events they are not authorized to modify. The vulnerability arises because the import module does not verify event modification rights before saving output from modules that return results in the 'misp_standard' format. As a result, a view-only user could inject or alter event data, compromising the integrity of MISP event content. The vulnerability has been addressed by enforcing the same modification rights check that is used in related module result handling paths, ensuring that only authorized users can make changes to event data.

A stored cross-site scripting vulnerability has been identified in the AVideo Meet plugin, specifically in the getMeetInfo.json.php endpoint. This vulnerability allows an anonymous, unauthenticated attacker to inject HTML/JavaScript payloads by manipulating the User-Agent header when joining public meetings. The injected payload is persisted in the meet_join_log.user_agent database field and executed in the browser session of the meeting host or site administrators when they access the Participants management panel. The vulnerability arises because the User-Agent header is stored without proper sanitization, bypassing AVideo's built-in XSS protection, and later displayed without output encoding.

A SQL injection vulnerability has been identified in n8n versions prior to 1.123.61, 2.x prior to 2.27.4, and 2.28.x prior to 2.28.1. The issue arises in the legacy MySQL v1 node's executeQuery operation, where evaluated expression values are directly inserted into the SQL string without proper parameterization. This flaw allows attacker-controlled input to manipulate the SQL query, executing arbitrary SQL commands with the privileges of the MySQL credentials used in the workflow. The vulnerability is exploitable when the workflow is connected to an externally reachable trigger, such as a Webhook node. Notably, the MySQL v2 node is not affected, as it employs parameterized queries.

A vulnerability exists in n8n versions prior to 2.28.0, allowing authenticated users to improperly assign workflows to folders in other projects. This issue arises from a failure to enforce proper authorization, enabling users to bypass project and folder boundaries by sending crafted request payloads during workflow creation. As a result, logical integrity violations occur in the folder structures of the targeted projects.

A stored CSS injection vulnerability has been identified in Grav versions prior to 2.0.0, affecting through 2.0.0-rc.9 and the 2.0 branch. The vulnerability arises in the Markdown image 'resize()' media action, where caller-controlled values are directly written into the image's style attributes. This allows a lower-privileged content editor to inject CSS declarations that are rendered when a higher-privileged user views the page or preview. The issue does not require JavaScript execution but enables UI redress and content manipulation attacks, such as creating a full-viewport fixed overlay.

A vulnerability in the Grav API plugin, affecting versions through v1.0.0-rc.15, allows unauthenticated attackers to make authenticated cross-origin API requests by exploiting a CORS wildcard and JWT token leakage via the URL query parameter. This vulnerability enables the creation of persistent backdoor super-admin accounts and the exfiltration of sensitive configuration and user data. The issue arises because the plugin accepts JWT tokens in the query string of every API route, and the CORS policy allows all origins to read the response, bypassing normal credential restrictions.

A vulnerability allowing unrestricted file uploads has been identified in the Grav API plugin (getgrav/grav-plugin-api) version 1.0.0. The issue resides in the avatar upload endpoint, which only validates the client's declared MIME type, allowing authenticated users to upload arbitrary content, including PHP scripts and SVG files with embedded JavaScript. The uploaded files are stored on the server under user/accounts/avatars/ with predictable filenames. While direct access to these files is restricted by .htaccess, they remain on disk, could be included in backups, and might lead to remote code execution or stored cross-site scripting under certain conditions.

A vulnerability allowing unauthenticated arbitrary file uploads has been identified in the Blocksy Companion Pro plugin for WordPress, in versions prior to 2.1.47. This vulnerability arises from inadequate extension validation in the save_attachments function, part of the Advanced Reviews feature. Attackers can exploit this flaw by uploading executable files with double-extension names, such as shell.woff2.php, which bypass the validation and are executed by the web server as PHP files, leading to remote code execution.

A vulnerability exists in n8n versions prior to 2.25.7 and 2.26.x prior to 2.26.2, allowing an authorization bypass in the Public API execution retry endpoint. The vulnerability arises because access is authorized using the workflow:read scope instead of the workflow:execute scope. This flaw enables an authenticated user with read-only access to a shared workflow to use the Public API to retry executions of that workflow, thereby bypassing the intended permission boundary between read and execute access. The issue is particularly relevant in instances where workflows are shared with other users or across projects.

A vulnerability exists in n8n versions prior to 1.123.55, 2.25.7, and 2.26.2, allowing an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint. This endpoint incorrectly authorizes access using the workflow:read scope instead of workflow:execute. As a result, an authenticated user with read-only access to a workflow can initiate a real evaluation test run. This execution occurs through the internal workflow runner, potentially leading to unintended outbound API calls, data changes, or other side effects in connected downstream systems. The vulnerability is particularly relevant for instances using the Evaluations feature, where RBAC project roles provide workflow:read access without workflow:execute.

A vulnerability exists in n8n versions prior to 1.123.55, 2.25.7, and 2.26.2, allowing unauthorized state-changing actions through three mutating evaluation test-run endpoints. The issue arises because these endpoints incorrectly authorize actions using the 'workflow:read' scope instead of the appropriate 'workflow:execute' scope. This vulnerability affects instances with Advanced Permissions (Enterprise/Cloud) that utilize projects and viewer roles. An authenticated user with the project:viewer role can initiate new evaluation test runs, cancel ongoing runs, and delete run records for workflows that are only accessible in a read-only capacity.

A null pointer dereference vulnerability has been identified in Wazuh versions prior to 5.0.0-beta3, specifically within the 'wazuh-modulesd' component's handling of FlatBuffer 'DataValue' messages during inventory synchronization. This vulnerability allows an enrolled agent to send a valid 'DataValue' message that omits the optional 'id' field. The 'wazuh-modulesd' process crashes when it attempts to dereference 'data->id()->string_view()' without checking for null, leading to a denial-of-service condition.

A heap buffer overflow vulnerability has been identified in ImageMagick versions prior to 7.1.2-19. This vulnerability arises in the FTXT encoder, where missing boundary checks allow remote attackers to craft malicious FTXT image files that trigger out-of-bounds reads. Such exploitation can lead to denial-of-service conditions or unauthorized information disclosure.

A heap-buffer-overflow read vulnerability has been identified in ImageMagick versions prior to 7.1.2-15 and 6.9.13-40. This vulnerability arises in the GetPixelIndex function, where the OpenPixelCache method updates image channel metadata before allocating memory for the pixel cache. Attackers can exploit this flaw by causing memory and disk allocation failures, leading to a heap-buffer-overflow read that affects any writer using GetPixelIndex.

A vulnerability exists in n8n versions prior to 1.123.18 and between 2.0.0 and 2.6.2, where the ZendeskTrigger node does not properly verify HMAC-SHA256 signatures on webhooks from Zendesk. This flaw allows attackers who are aware of the webhook URL to send unsigned POST requests, triggering workflows with arbitrary malicious data. The lack of signature verification enables the injection of crafted payloads into the workflow.

A cross-site scripting vulnerability has been identified in n8n versions prior to 2.8.0 and 2.6.4. This issue allows authenticated users to inject malicious JavaScript URLs into the Authorization URL fields of OAuth2 credentials. Attackers can create harmful credentials and persuade victims to click the OAuth authorization button, which would execute the injected scripts in the context of the victim's browser session.

A vulnerability exists in Capgo versions prior to 12.128.2, where the application fails to remove EXIF metadata from images uploaded through the app information endpoint. This oversight allows attackers to access sensitive geolocation data and other embedded metadata from the uploaded files.

A use-after-free vulnerability has been identified in FreeRDP versions prior to 3.22.0. This vulnerability arises from improper synchronization of channel callback access in the DRDYNVC client. A malicious RDP server can exploit this issue by sending DYNVC_DATA and DYNVC_CLOSE messages simultaneously, creating a race condition. This leads to a heap-use-after-free situation in the DRDYNVC client thread, which could potentially allow for remote code execution or cause a denial-of-service condition.

An authorization vulnerability has been identified in Capgo versions prior to 12.128.2, specifically within the transfer_app() function. This flaw arises because the function fails to update the deploy_history.owner_org when applications are transferred between organizations. As a result, unauthorized access to deployment history records can be retained in the source organization, or the destination organization may lose access to the deployment records of transferred applications.

An information disclosure vulnerability exists in Capgo versions prior to 12.128.2, specifically within the Supabase PostgREST RPC function public.get_total_metrics(org_id). This function can be accessed by the anon role using only the public sb_publishable_* key. Unauthenticated attackers can exploit this vulnerability to probe the existence of organizations and leak sensitive usage metrics such as monthly active users (MAU), bandwidth, and installation counts. The vulnerability is triggered by sending POST requests to /rest/v1/rpc/get_total_metrics with valid organization UUIDs.

A HTML injection vulnerability has been identified in Capgo versions prior to 12.128.2, specifically within the organization settings endpoint. This vulnerability allows attackers to inject malicious HTML into the organization name field, which can then be used to redirect users to untrusted websites. Such redirections could facilitate phishing attacks and cause reputational harm to the affected organization.

A path traversal vulnerability has been identified in Flowise versions prior to 3.1.0, specifically within the Faiss and SimpleStore vector store implementations. These versions accept unsanitized basePath parameters from authenticated users. Exploitation of this vulnerability allows attackers with valid API tokens to write vector store data to arbitrary locations on the server filesystem. This could potentially lead to code execution or data exfiltration.

A vulnerability in Capgo versions prior to 12.128.2 allows upload-scoped API keys to manipulate the app_versions.r2_path field through PostgREST. This manipulation enables the retargeting of R2 bundle objects. Attackers can change the r2_path to point to victim objects, soft-delete the version they control, and activate a cleanup function that deletes the victim's R2 object, leading to a denial-of-service and disruption of bundle availability.

A broken access control vulnerability has been identified in the Capgo organization management API, prior to version 12.128.2. This vulnerability allows a scoped API key, limited to specific organizations, to inherit the permissions of its owner-user. As a result, it can perform destructive actions across organizations. For instance, if a user is an admin in two organizations and creates a write-mode API key restricted to one organization, that key can still execute harmful operations, such as deleting organization data or members, in another organization. The issue arises from a flaw in route-level authorization, which fails to properly enforce the API key's organizational limitations before applying the owner's user privileges, enabling unauthorized cross-organization actions.

A vulnerability in Capgo versions prior to 12.128.2 allows unauthenticated access to sensitive organization data through the Supabase PostgREST RPC function public.get_orgs_v6. This function, which is SECURITY DEFINER and granted to the anon role, accepts a caller-supplied user UUID without verification. An attacker can use the public publishable API key to query the function and retrieve information about a user's organization membership, roles, subscription or trial metadata, and management email, which is considered personally identifiable information (PII).

An authorization bypass vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability allows read-only organization members to insert rows into the public.manifest table, which stores over-the-air (OTA) update metadata. The inserted rows can include malicious entries with arbitrary S3 path values. These entries are then served to devices via the unauthenticated /updates endpoint, potentially leading to OTA metadata poisoning and the delivery of malicious assets. The issue arises from a mismatch in authorization, as the manifest insertion policy only checks for organizational membership and does not require upload or write permissions, allowing low-privileged users to modify live update metadata.

A policy bypass vulnerability has been identified in Capgo versions prior to 12.128.2. This vulnerability allows app-scoped API keys to downgrade encrypted bundles to a non-encrypted state, bypassing organization-enforced policies. The issue arises because the database only enforces bundle encryption requirements on insertion, leaving a gap that can be exploited by directly updating the app_versions table via PostgREST. This manipulation clears important fields, undermining over-the-air security controls.

An incorrect authorization vulnerability has been identified in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6, as well as in LTS2026 release versions 8.6.1.0 through 8.6.1.10, LTS2025 release versions 8.3.1.0 through 8.3.1.30, and LTS2024 release versions 7.13.1.0 through 7.13.1.70. This vulnerability allows a low privileged attacker with remote access to gain unauthorized access to the system.

A vulnerability exists in Dgraph Alpha versions through 25.3.4, where the RPCs for external snapshot import are exposed on the public gRPC port :9080 without any authentication or authorization. This allows an unauthenticated network client to initiate the 'StreamExtSnapshot' RPC and send Badger stream data to the target group's store. The vulnerability is particularly concerning because the 'Prepare()' method is called before the stream is processed, leading to the deletion of existing database data. This issue has been patched in version 25.3.5.

An integer overflow vulnerability has been identified in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, as well as in LTS2026 release versions 8.6.1.0 through 8.6.1.10, LTS2025 release versions 8.3.1.0 through 8.3.1.30, and LTS2024 release versions 7.13.1.0 through 7.13.1.70. This vulnerability allows an unauthenticated attacker with remote access to potentially cause a denial-of-service condition on the affected system.

A path traversal vulnerability has been identified in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, as well as in LTS2026 release versions 8.6.1.0 through 8.6.1.10, LTS2025 release versions 8.3.1.0 through 8.3.1.30, and LTS2024 release versions 7.13.1.0 through 7.13.1.70. This vulnerability arises from an improper limitation of pathnames, allowing a high-privileged attacker with remote access to potentially exploit the issue and make unauthorized modifications to files.

A DQL injection vulnerability has been identified in the Dgraph GraphQL database, affecting versions through 25.3.3. The issue arises in the checkUserPassword query, where user-provided password values are directly inserted into a DQL checkpwd() query using fmt.Sprintf, without proper escaping or parameterization. This flaw allows attackers to inject passwords containing double-quote characters to escape the DQL string literal and append arbitrary DQL query blocks. The vulnerability exists in the GraphQL-to-DQL query rewriting layer, specifically in query_rewriter.go, where the checkpwd() function is constructed with unsanitized input. Exploitation can lead to unauthorized data enumeration, schema discovery, resource exhaustion, and potential data disclosure, depending on the Dgraph configuration.

A stored cross-site scripting vulnerability has been identified in Dell PowerProtect Data Domain. This issue affects versions 7.7.1.0 prior to 8.7, LTS2026 release versions 8.6.1.0 through 8.6.1.10, LTS2025 release versions 8.3.1.0 through 8.3.1.30, and LTS2024 release versions 7.13.1.0 through 7.13.1.70. The vulnerability allows an unauthenticated attacker with remote access to inject malicious scripts, which could be executed in the context of the user's browser. Exploitation of this vulnerability may lead to information disclosure, session theft, or client-side request forgery.

A local privilege escalation vulnerability has been identified in Omnissa Workspace ONE Tunnel for Windows. This vulnerability allows users to gain elevated privileges on the affected system.

A denial-of-service vulnerability has been identified in Tanium Server. This issue allows an unauthenticated, network-based attacker to disrupt the normal functioning of the Tanium Server.

A command injection vulnerability has been identified in bentoml OpenLLM version 0.6.30. The issue arises in the 'async_run_command' function within 'src/openllm/common.py', specifically in the Model Repository Directory Name Handler component. The vulnerability allows for arbitrary command execution by manipulating the 'cmd' argument, with exploitation requiring local execution. This vulnerability has been publicly disclosed.

A cross-site request forgery (CSRF) vulnerability exists in Flask-MonitoringDashboard versions through 5.0.2. The issue arises in the user creation endpoint, where the lack of CSRF protection allows an attacker to manipulate an authenticated administrator into creating a new admin account with attacker-chosen credentials. This vulnerability can be exploited remotely, leading to a persistent takeover of the monitoring dashboard.

A command injection vulnerability has been identified in Christopher Thielen's 'check-peer-dependencies' package, specifically in version 4.3.4. The issue arises in the 'peerDependencies' handling, where package names are extracted from 'package.json' and interpolated into shell commands. This flaw allows for the execution of arbitrary operating system commands, potentially initiated remotely. The vulnerability was reported to the project, but no response has been received.

A stored cross-site scripting vulnerability has been identified in Webbeyaz Web Design's Mediküm Web application, affecting versions through 08072026. This issue arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are permanently stored and executed in the context of the user.

A reflected cross-site scripting vulnerability has been identified in Webbeyaz Web Design's Mediküm Web application, affecting versions through 08072026. This issue arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that are executed in the context of the user's browser.

A SQL injection vulnerability has been identified in Webbeyaz Web Design's Mediküm Web application, affecting versions through 08072026. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing attackers to manipulate database queries and potentially access or modify database information.

A stored cross-site scripting vulnerability has been identified in the VikBooking Hotel Booking Engine & PMS plugin for WordPress, affecting all versions through 1.8.8. The issue arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts into pages. These scripts are executed when users access the compromised pages.

A stored cross-site scripting vulnerability has been identified in the Nexter Blocks plugin for WordPress, affecting all versions through 4.7.4. The issue arises from inadequate input sanitization and output escaping, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts into pages. These scripts are executed when a user accesses the compromised page.

A stored cross-site scripting vulnerability has been identified in the Essential Addons for Elementor - Popular Elementor Templates & Widgets plugin for WordPress. This issue affects all versions through 6.6.2 and arises from inadequate input sanitization and output escaping on event titles retrieved from The Events Calendar. As a result, authenticated attackers with Author-level access can inject arbitrary web scripts into pages, which will execute when users access the compromised page.