CVE Vulnerability Catalog

A vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier is caused by an uncontrolled search path element, potentially allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file. The scope has changed.

A vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier is caused by an uncontrolled search path element, potentially allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file. The scope of the vulnerability has changed.

In CedarJava library versions prior to 2.3.6, 3.4.1, and 4.9.0, a vulnerability allows Cedar-expression injection due to improper input handling. The toCedarExpr() method does not escape special characters, enabling injection of arbitrary policy expressions.

In CedarJava versions prior to 4.9.0, the EntityIdentifier.equals() method has inverted logic for null and self-reference checks, causing incorrect equality comparisons. This does not affect Cedar authorization decisions but may impact integrators performing their own entity identifier comparisons.

CedarJava prior to versions 2.3.6, 3.4.1 and 4.9.0 contains a vulnerability where improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.

A file upload vulnerability in Laravel-Mediable before version 7.0.0 allows unauthenticated attackers to achieve remote code execution by uploading a file with a double extension like shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension, and on misconfigured Apache or nginx servers, the file is executed as PHP while MIME and extension validation pass due to the outer .jpg.

A path traversal vulnerability was discovered in the Laravel-Mediable library before version 7.0.0 in the File::sanitizePath() function. It allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination().

Laravel-Mediable before version 7.0.0 contains a server-side request forgery (SSRF) vulnerability. It allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource().

OpenBMB XAgent version 1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path without proper validation, allowing directory traversal that may lead to sensitive information disclosure.

LogicalDOC Enterprise versions up to 9.1.1 are vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.

A path traversal vulnerability was found in the mcp-gitlab library in the job_id parameter of build/index.js. It allows attackers to redirect GitLab API requests to arbitrary endpoints.

Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack. S_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds. A template derived from untrusted input can read heap memory past the buffer and return it to the caller.

In Apache Airflow FAB auth manager, a DAG named `DAGs` collides with the global all-DAGs permission resource name. A user granted per-DAG access to that specific DAG silently receives global all-DAGs permissions, leading to privilege escalation.

The Apache Airflow Git provider defaults to StrictHostKeyChecking=no for git-over-SSH operations, disabling SSH host-key verification. An attacker can intercept the network path between an Airflow worker and the Git server (man-in-the-middle), impersonate the server, capture the SSH deploy key, or inject malicious repository content.

A buffer overflow vulnerability has been found in the "extension/readdir.c" file of gawk in the ftype() routine. This issue could crash the program and potentially allow code execution, although the latter has not been confirmed. It affects gawk versions 5.4.0 and below.

A Use After Free vulnerability has been found in the io.c file of gawk in the do_getline_redir() routine. It affects gawk versions 5.4.0 and below and may lead to a crash.

A privilege escalation vulnerability in the incluster-checks tool for OpenShift allows any user with the standard edit role to exec into privileged debug pods with host filesystem access and obtain root access on cluster nodes.

The WordPress plugin "ووسلام – همگام سازی ووکامرس و باسلام" (sync-basalam) version up to 1.9.1 is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick an administrator into performing unintended actions within their session context.

The WordPress plugin 'گرویتی فرم فارسی' (persian-gravity-forms) contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. The issue affects versions up to and including 3.0.2.