Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross …
A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api_plugins.php of the component Plugin Inst…
LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/dis…
@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because fi…
DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unserialize() without restricting allowed classes. Authenticated …
Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers ca…
Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Att…
LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_editor lp-ajax actions, allowing instructors to modify other i…
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can o…
libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large X…
react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField.…
OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authenticated users to modify or delete other users' calendar events…
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permissio…
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level …
OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can …
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users…
OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authentica…
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic inte…
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be use…
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions.…