CVE Vulnerability Catalog

A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_file_content/save_file_content/move_files/start_streaming of the file page.html. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. Upgrading to Kiro IDE version 1.0.242 or later is recommended.

Mailspring is a fast, cross-platform, open-source email client. Prior to 1.17.0, attachment quick preview converts Markdown, DOCX, and XLSX attachments with Snarkdown, Mammoth, and SheetJS and inserts the resulting HTML into the preview document through innerHTML without sanitization. A remote sender can craft a supported attachment whose converted HTML executes script when a recipient opens quick preview. The preview renderer has no direct Node or Electron access, but injected script can reach the IPC surface exposed to the quick-preview renderer. This issue alone provides script execution in the preview renderer; separate path-traversal and renderer-controlled file-write vulnerabilities are required for the documented persistent code-execution chain. This issue is fixed in version 1.17.0.

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, attacker-controlled upload filenames used in chat message excerpts were rendered as unescaped HTML. A user able to upload a file and send chat content could place markup in a filename that was then interpreted by chat channel lists, chat summary emails, pinned message bars, reply previews, thread previews, and other excerpt renderers. The issue allowed trusted-HTML injection that altered rendered excerpt content, but JavaScript execution was not demonstrated with default Content Security Policy settings. The advisory states that no confidentiality, integrity, or availability impact was identified, while its structured scoring metadata separately assigns low integrity impact. Sites that disable or relax the default CSP have increased exposure. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could create a post for an enabled YouTube, Vimeo, or TikTok provider whose title contained markup, and the email and chat-summary rendering path would place that markup into the output instead of treating it solely as text. Recipients using HTML-capable email clients could see injected content, potentially including event handlers, but the issue did not directly expose a Discourse browser session or affect the forum page itself. Lazy video embeds must be enabled, which is the default configuration. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form action_code_who value into mention-link href attributes without URL encoding. A quote-bearing display name could terminate the intended URL attribute and inject attacker-controlled elements into the trusted rendered markup. Although the visible mention text was escaped, the unencoded path component allowed stored HTML injection when another user viewed the affected topic action or activity log. This issue is fixed in versions 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0.

ZITADEL, an open source identity management platform, from 3.0.0 until 3.4.13 and 4.16.1 contains a vulnerability in Actions V1 that enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. This issue is fixed in versions 3.4.13 and 4.16.1.

ZITADEL, an open source identity management platform, from 4.0.0 until 4.16.1 contains a vulnerability in Login V2 that creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

In ESP-IDF versions 5.5.5, 6.0.1, and 6.1, the BlueDroid A2DP sink function btc_a2dp_sink_handle_inc_media() reads a timestamp field from the media buffer before validating that the packet contains that field. A paired BR/EDR audio source within radio range can send a malformed A2DP packet, causing an out-of-bounds read into adjacent heap memory and limited disclosure of heap contents.

Wazuh, an open-source security platform providing unified XDR and SIEM protection, from 3.9.0 until 4.14.7 contains a vulnerability in wazuh-clusterd in framework/wazuh/core/cluster/common.py where a payload buffer is allocated using the size declared in a 20-byte cluster protocol header before Fernet decryption validates the peer. An unauthenticated network peer can declare a payload of up to 256 MiB, stop sending after the header, and retain that allocation until the TCP connection closes. The cluster listener has no application-level per-source connection budget, allowing concurrent sockets to multiply memory consumption and potentially terminate the cluster process, disrupt synchronization, and interrupt distributed API forwarding. This issue is fixed in version 4.14.7.

OpenObserve prior to version 0.90.3 exposes the /config/runtime endpoint without authentication, allowing an unauthenticated network client to read the full server configuration. The hide_sensitive_fields filter does not recognize dsn or creds field names, potentially exposing database credentials, administrator email, and other deployment details. This issue is fixed in version 0.90.3.

zbateson/mail-mime-parser versions 2.0.0 through 3.0.5 and 4.0.0 through 4.0.1 contain an uncontrolled resource consumption vulnerability (CWE-400). Three independent parsing paths have super-linear cost, so a crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory, causing denial of service. The cost is incurred on the first getAllParts() or content read.

The zbateson/mail-mime-parser library prior to versions 3.0.6 and 4.0.2 is vulnerable to CRLF header injection (CWE-93) when building MIME messages with attacker-influenced attachment filenames. Filenames containing CR/LF can be serialized as additional header lines, such as a forged Bcc, enabling message exfiltration. Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches.

In Wazuh from 3.8.0 until 4.14.7, the _getattributes() function in src/os_xml/os_xml.c recursively processes every XML attribute without a depth limit while allocating two large local buffers per stack frame. An enrolled agent can submit a Windows EventChannel event with an element containing enough attributes to exhaust the analysisd worker-thread stack, causing a segmentation fault and interrupting log ingestion.

DBHub prior to version 0.22.6 does not enforce read-only mode for the execute_sql tool even when readonly = true is set. The code that would enforce read-only is never executed, leaving only a simple classifier that checks the first keyword of each statement. This allows sequence tampering, arbitrary file writes, host file reads, and remote code execution. The HTTP transport is unauthenticated and binds to 0.0.0.0 by default.

xhtml-purifier versions prior to 0.4.3 do not HTML-entity-encode attribute values when serializing sanitized output. In attributeString() the attribute value is concatenated directly into a double-quoted attribute, so an attacker-controlled value can include a double-quote to break out and inject an additional attribute, such as a JavaScript event handler.

Rsdoctor prior to version 1.5.16 starts a default HTTP report server that binds to all network interfaces (0.0.0.0) and exposes a POST /api/data/key endpoint without authentication and with wildcard CORS. This allows a remote attacker to retrieve full source code of compiled JavaScript modules, build configuration, and other sensitive data. The server is enabled by default in non-CI environments.

DBHub, a database MCP server, in versions prior to 0.22.5 exposes an unauthenticated HTTP MCP endpoint when started in HTTP transport mode. Its protection based on comparing Origin and Host headers does not prevent DNS rebinding, allowing a malicious website to invoke MCP tools from the victim's browser. Depending on configuration, this can lead to reading, enumerating, and potentially writing database contents.

The http4s-scala-xml library in versions prior to 0.24.1 and 1.0.0-M39 uses a SAXParserFactory without security configuration to decode XML message bodies. With default JDK settings, the parser resolves DOCTYPE declarations, external entities, and external DTDs. Applications parsing untrusted XML are vulnerable to XXE, SSRF, and resource exhaustion attacks.

Decepticon, an autonomous hacking agent for red teams, in versions prior to 1.1.17 wraps web crawl results into LLM messages without neutralizing ChatML special-token literals. Under the BYOK model, most model providers do not filter these literals, so an attacker can plant them on a target page to forge an operator turn and bypass agent guardrails. This results in arbitrary command execution inside the Kali Linux sandbox.