CVE Vulnerability Catalog

In the display component, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.

In the display component, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.

In the display component, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained System privilege. User interaction is not needed for exploitation.

In the Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Modem component, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges or user interaction needed.

In the Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service if a UE connects to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. After sign-in, the token is not sufficiently marked as used, allowing an attacker who intercepted the token (e.g., during a screen share) to reuse it within the 60-second validity window along with known credentials. This is fixed in version 1.12.0.

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a server instance or has their permissions changes with respect to file access over SFTP. This allows a user that was already connected to SFTP to remain connected and access files even after their permissions are revoked. A user must have been connected to SFTP at the time of their permissions being revoked in order for this vulnerability to be exploited. This issue is fixed in version 1.12.0.

AIOHTTP versions 3.13.2 and below have a vulnerability where reading multiple invalid cookies can cause a logging storm. An attacker can craft a Cookie header to trigger excessive warning logs if the cookies attribute is accessed.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an application makes use of the request.read() method in an endpoint, it may be possible for an attacker to cause the server to spend a moderate amount of blocking CPU time (e.g. 1 second) while processing the request. This could potentially lead to DoS as the server would be unable to handle other requests during that time. This issue is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the possibility that there's a method to exploit a request smuggling vulnerability. This issue is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files meant to prevent path traversal. If an application uses web.static() (not recommended for production), an attacker may ascertain the existence of path components. This is fixed in version 3.13.3.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version of AIOHTTP is installed (i.e. without the usual C extensions) or AIOHTTP_NO_EXTENSIONS is enabled, then an attacker may be able to execute a request smuggling attack to bypass certain firewalls or proxy protections. This issue is fixed in version 3.13.3.

Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 have an SSRF vulnerability in the GraphQL `save_<VolumeName>_Asset` mutation. The `url` parameter in the `_file` input allows fetching content from arbitrary remote locations without validation, potentially leading to data exposure and infrastructure compromise.

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests.

Dify, an open-source LLM app development platform, prior to version 1.11.0 exposes the API key in plaintext to the frontend, allowing non-administrator users to view and reuse it. This can lead to unauthorized access to third-party services and quota consumption. Version 1.11.0 fixes the issue.

Coolify (starting with version 4.0.0-beta.434) has a vulnerability that allows bypassing the rate limit on the /login endpoint by rotating the X-Forwarded-For header. This enables unlimited credential stuffing and brute-force attempts against user and admin accounts.

Coolify versions prior to and including v4.0.0-beta.420.8 have an information disclosure vulnerability in the `/api/v1/teams/{team_id}/members` and `/api/v1/teams/current/members` API endpoints. An authenticated team member can read a highly sensitive `email_change_code` belonging to other users on the same team. This code is intended for single-use email change verification and should remain secret.

An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser. The supplier is currently disputing this finding and the record is under review.