CVE Vulnerability Catalog

zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump().

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int.

NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specially crafted SVG document containing extreme arc radius values can cause intermediate arc calculations to produce a NaN delta angle.

minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.

MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation.

SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineMupdf::BuildPageLabelRec() when parsing PDF PageLabels /Nums entries.

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access buf[len] after the input buffer has been exhausted.

nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can cause byte-buffer addresses at odd offsets to be cast to uint16_t or wider integer pointers and directly dereferenced without alignment checks.

An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including constants, variables, and zero-argument functions, the function allocates less memory than sizeof(te_expr) but treats the returned allocation as a complete te_expr object.

Termix versions 1.7.0 through 2.5.1 derive a grep pattern from user-controlled public-key input and interpolate it into shell commands executed on the target host during SSH key deployment. An authenticated user can inject shell syntax and execute commands with the privileges of the selected remote account. The issue is fixed in version 2.5.1.

Termix versions 2.5.0 through 2.5.1 allow authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests via the notification-channel test endpoint. The lack of destination allowlisting or private-address blocking permits blind requests to internal HTTP services. The issue is fixed in version 2.5.1.

Termix versions 1.7.0 through 2.5.1, in the POST /credentials/:id/deploy-to-host endpoint, resolves credential and target-host records from attacker-controlled credentialId and targetHostId values without verifying ownership. Differential errors reveal record existence and authType values, and a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. The issue is fixed in version 2.5.1.

Termix versions 1.8.0 through 2.5.1 allow authenticated users to access the server-stats API without per-host authorization. GET /status, GET /status/:id, and POST /clear-connections expose host state and let a regular user clear the global SSH connection pool. The issue is fixed in version 2.5.1.

BentoPDF in 2.8.6 and earlier has a vulnerability in the certificate and timestamp CORS proxy in cloudflare/cors-proxy-worker.js that uses isPrivateOrReservedHost() to validate a supplied hostname separately from the DNS resolution used by fetch(targetUrl), allowing an attacker-controlled hostname to resolve to an internal or reserved destination after validation. A certificate-like path can satisfy ALLOWED_PATH_PATTERNS, and direct clients can forge the Origin header. Deployments without PROXY_SECRET skip the optional signature check.

LaSuite Doc versions 4.8.2 through 5.4.0, in GET /api/v1.0/documents/search/, accepts sequential seven-digit document paths without requiring the caller to know the public UUID. An unauthenticated attacker can enumerate public document subtrees, obtaining identifiers, titles, creator data, and metadata, while differing 403/404 responses reveal path existence. The issue is fixed in version 5.4.0.

The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212 NFC chip. A UID is a manufacturer serial number sent in the clear on every read and is not intended to be secret or to authenticate the holder.

RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1 allow a monitoring-tagged user to delete or restart any dynamic shovel in any vhost they can see. The shovel management resource delegates authorization to a monitoring check even though DELETE should be restricted to the policymaker role. The issue is fixed in the listed versions.

BentoPDF is a client-side PDF toolkit that is self hostable. In 2.8.6 and earlier, deserializeWorkflow() accepts the Timestamp node's tsaUrl control from imported JSON without schema or destination validation. When a user imports the crafted workflow and runs it against a PDF, timestampPdf() sends an RFC 3161 TimeStampReq containing the PDF's SHA-256 MessageImprint to the attacker-selected endpoint. The default self-hosted configuration does not set VITE_CORS_PROXY_URL, so the request bypasses the proxy's ALLOWED_TSA_HOSTS checks and is sent directly. The disclosed digest can confirm that a document matches a known file and can correlate the same document across users without revealing its contents. This vulnerability is fixed in 2.8.7.

Logto from 1.31.0 to 1.42.0 has a vulnerability in the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts that allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterprise SSO provider access tokens through GET /api/my-account/identities/{target}/access-token or GET /api/my-account/sso-identities/{connectorId}/access-token. The handlers authenticate the user but do not require the identities scope that protects neighboring identity-detail operations, bypassing the intended Account API consent boundary.

Logto before version 1.43.0 fetches administrator-controlled outbound destinations without validating the connection address. Webhook delivery and custom/OIDC connectors can reach special-use and cloud metadata addresses, potentially exposing internal data or upstream provider credentials. This issue is fixed in version 1.43.0.