CVE Database

VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users …

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is …

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers …

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administrators with basic_settings permission …

ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.php?type= links to …

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id …

Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying …

Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip …

Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own …

Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied organizationId. …

frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the …

SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call …

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is …

NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null …

jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers …

Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the …

youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers …

vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can …

REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privilege users can …

ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs …

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem …

BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows authenticated members to act …

BizSpring Shop through commit cf22d39daaf1 contains a payment verification bypass vulnerability that allows authenticated buyers to mark orders paid by calling the PaymentController.testPostPay handler. Attackers …

LibreCAD libdxfrw through LC2.2.0 (LibreCAD through 2.2.1.5) contains a stack-based out-of-bounds read vulnerability in dwgReader18::readFileHeader() caused by calling strlen on non-NUL-terminated buffers. Attackers can supply …

libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the …

Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Attackers can supply XML with …

LASzip through 3.5.0 contains an invalid free vulnerability in laszip_read_header() that allows attackers to free uninitialized heap pointers via truncated variable length record data. Attackers …

libmspack through 0.11alpha contains an uninitialized pointer free vulnerability in kwajd_open() in mspack/kwajd.c that frees unzeroed filename and extra pointers on header read errors. Attackers …

libsixel before 1.8.7-r1 and 1.9.0 through 1.10.5 contains a heap out-of-bounds write vulnerability in gif_init_frame() in src/fromgif.c, which never checks the GIF transparent color index …

xlsxio through 0.2.37 contains a NULL pointer dereference vulnerability in main_sheet_get_sheetfile_expat_callback_element_start() in lib/xlsxio_read.c that allows attackers to crash applications via crafted files. Attackers can supply …

L-SMASH through 2.14.5 contains a double free vulnerability in hevc_setup_first_summary() and h264_setup_first_summary() in importer/nalu_imp.c that frees borrowed codec-specific objects on error paths. Attackers can supply …

Libyal libpff through 20260926 contains an integer underflow in libpff_record_entry_get_multi_value() that allows attackers to trigger heap out-of-bounds reads via non-monotonic multi-value offsets. Attackers can craft …

Tinyexr through 3.2.0 contains a heap out-of-bounds read vulnerability in ParseEXRMultipartHeaderFromMemory() that allows attackers to read beyond buffers due to a stale remaining-size value. Attackers …

quirc through 1.2 contains an excessive-iteration vulnerability in find_alignment_pattern() in lib/identify.c that allows attackers to hang quirc_end() with a crafted image. Attackers can arrange three …

BottleCRM 0.45 through 1.14.5 contains an uncontrolled memory allocation vulnerability in _read_upload() that reads entire CSV uploads before enforcing the 5 MB limit. Authenticated users …

BottleCRM 0.43 through 1.14.5 contains a regular expression denial of service vulnerability that allows authenticated organization administrators to block web workers via unbounded routing rule …

BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_body with django.template.Template(). Authenticated organization members …

BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup into custom-template invoice PDFs. Attackers can …

OW2 ASM 1.4.3 before 9.11 contains an excessive resource consumption vulnerability in Analyzer.analyze() that allows attackers to exhaust memory and CPU via crafted class files. …

OW2 ASM 3.0 before 9.11 contains an uncontrolled memory allocation vulnerability in the asm-commons JSRInlinerAdapter that inlines JSR/RET subroutines without memory or work limits. Attackers …

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in SignatureReader.parseType() that allows attackers to exhaust the stack via deeply nested generic type signatures. …

OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exhaust memory by supplying crafted class …

OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files processed with ClassWriter.COMPUTE_FRAMES. …

OW2 ASM 3.0 before 9.11 contains a quadratic memory allocation vulnerability in MethodWriter.computeMaxStackAndLocal() and computeAllFrames() when using COMPUTE_MAXS or COMPUTE_FRAMES. Attackers can supply a crafted …

OW2 ASM 3.0 before 9.11 contains an uncontrolled recursion vulnerability in ClassWriter.replaceAsmInstructions() that allows attackers to cause denial of service through crafted class files. Attackers …

OW2 ASM 3.0 before 9.11 contains an excessive memory allocation vulnerability in Label.addSubroutineRetSuccessors() that fails to enforce the single-RET-per-JSR rule. Attackers can supply a crafted …

OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an int array from num_bootstrap_methods without validating attribute_length. Attackers can …

svg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, Resolver::processReferences() in src/ElementReference/Resolver.php builds the SVG <use> reference graph with a case-sensitive href attribute predicate before …

Description NGINX Ingress Controller has a vulnerability when implementing an externalAuth policy for ingress. NGINX Ingress Controller may mishandle the HTTP response from an OAuth …

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.31, 21.2.23, and 22.1.6, the @angular/platform-server …