| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| LogicalDOC Community Edition through 9.3 contains a username enumeration vulnerability that allows unauthenticated attackers to identify valid accounts because the AvatarServlet (/avatar) performs no session validation. Attackers can supply usernames or numeric IDs in the userId parameter and compare 1x1 transparent images against real avatars to enumerate users and retrieve profile pictures. |
| A vulnerability has been found in Netcore NR268 1.7.121109. The impacted element is the function ddns_wan_list_show of the file ddns_wan_list_show.cgi of the component DDNS Handler. The manipulation of the argument user_idN/passwordN leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4. |
| Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass enrollment password via the unmasked agent configuration endpoint. Attackers holding the default readonly role can request the auth component configuration for pseudo-agent ID 000 to obtain the secret and enroll rogue agents against the manager. |
| ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts attacker-controlled inner byte lengths and element counts without verifying that they fit in the containing packet. A malicious or compromised SSH server can return a small malformed packet whose oversized declarations cause the Kaitai Struct Java runtime to attempt excessive allocation or repeated parsing before detecting truncated input. The general transport path requires a client connection but no authentication or optional feature; malformed SSH-agent messages additionally require SSH agent forwarding. The issue can raise an uncaught OutOfMemoryError and terminate the application process, with no demonstrated confidentiality or integrity impact. This issue is fixed in version 0.3.1. |
| A vulnerability has been found in HBAI-Ltd Toonflow-app up to 1.1.8. This affects an unknown function of the component exportData Endpoint. Such manipulation leads to information disclosure. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 2.0.0 mitigates this issue. It is advisable to upgrade the affected component. The vendor explains: "The report targets ToonFlow version 1.1.8. The current release is 2.0.4, which is the result of a substantial architectural refactor; the code paths referenced in the report do not apply to the current version. The report does not describe a vulnerability in any supported release." |
| Mitigation bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. |
| Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentry package is affected by improper input validation in sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials. Subsequent impact depends on network reachability and the privileges granted to the configured token. This issue is fixed in version 0.3.8. |
| Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the first directive token on each line even though Nginx permits multiple semicolon-separated directives on one line. An authenticated caller can place a benign directive first and a restricted load_module, js_import, perl, or user root directive later on the same line, or can use an unrestricted include directive to load restricted content. These mechanisms bypass validation on REST, nginx_config_modify, site, and stream write paths; when an executable module is available, the injected configuration can execute code in the Nginx worker context. This issue is fixed in version 2.4.1. |
| IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to cause a denial of service due to improper input validation. |
| IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to the exposure of JavaScript source map files. |
| A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. |
| Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Low) |
| Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may receive internal execution data. In deployments where that data contains credentials for an external service, this may permit disclosure and unauthorized changes in that external service. This issue is fixed in versions 3.3.1, 3.4.1, 4.0.3 and 4.1.0. |
| Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose sensitive information in Scaffolder task failure events. Under specific template and failure conditions, an authenticated user may retrieve backend-managed credentials used during task execution from affected task events. This issue is fixed in version 4.1.0. |
| Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.3.4 until 1.107.4 and 2.27.1, OpenTelemetry instrumentation configured with InstrumentationSettings(include_content=False) can export retry prompts outside tool calls in gen_ai.input.messages and pydantic_ai.all_messages. Agents using NativeOutput, PromptedOutput, or output validators on text output can therefore disclose validation feedback, including invalid model values quoted by that feedback, to readers of the telemetry backend. Tool-call retries and deployments that do not use include_content=False are not affected by this specific path. This issue is fixed in versions 1.107.4 and 2.27.1. |
| IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to obtain sensitive information due to exposure of session tokens in the HTML response. |
| A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/main_util.py. Executing a manipulation of the argument src_ckpt can lead to deserialization. The attack needs to be launched locally. The exploit has been published and may be used. The project maintainer explains: "This is very similar to an internal report that GH auto-generated for the owner before, which I found tolerable for this project at that time. So I will close this as duplicate." |
| Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted. |
| A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. |
