CVE Vulnerability Catalog

In the Frappe framework prior to versions 16.23.0 and 15.112.0, a TarSlip RCE vulnerability was found in Package Import. Insufficient validation of tarfile members before extraction allowed remote code execution.

The Plotly.js Graphing plugin for Drupal contains an object injection vulnerability due to improperly controlled modification of dynamically-determined object attributes. Affected versions range from 0.0.0 to 3.0.2.

A vulnerability in the Flag attendance field module for Drupal allows improperly controlled modification of dynamically-determined object attributes, leading to object injection. Affected versions range from 0.0.0 to 1.2.

A vulnerability in Phalcon before version 5.14.1 allows an attacker to exploit a timing side-channel in the Phalcon\Encryption\Crypt::decrypt function, where the HMAC comparison is performed byte-by-byte and returns early on the first mismatch. This enables the attacker to recover a valid HMAC tag byte-by-byte and attach it to a chosen IV and ciphertext, causing decrypt() to accept tampered encrypted content as authentic.

ModSecurity before version 3.0.16 has a vulnerability in the multipart/form-data parser that silently removes line breaks from non-file form-field values. This occurs because the code overwrites reserved bytes instead of appending the current buffer, causing a parser differential between ModSecurity and backend applications.

In Frappe prior to version 16.19.0, an authorization bypass vulnerability was found in the update_page endpoint in Workspace. Public workspaces did not undergo the required Workspace Manager edit check.

An SSRF vulnerability in TypeBot prior to 3.17.2 allows bypassing the URL validator by using the IPv6 unspecified address ::. A workspace editor or creator can configure a server-side HTTP Request block or script fetch to connect to local HTTP services.

A vulnerability in Spinnaker allows remote code execution through unsafe YAML processing when using CloudFormation or CloudFoundry. The use of a non-safe constructor enables arbitrary Java class loading, leading to remote code execution.

In Frappe framework prior to version 16.18.3, a path traversal and local file inclusion vulnerability was possible through secure local resource access in the Chrome PDF Generator.

The Location Selector plugin for Drupal contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects all versions from 0.0.0 to 1.3.0.

A vulnerability in the Drupal Tealium iQ Tag Management module allows improperly controlled modification of dynamically-determined object attributes, leading to object injection. This affects versions from 0.0.0 to 2.4.0.

A vulnerability in the GPU driver allows a non-privileged user to execute a sequence of improper GPU system calls, leading to use-after-free. This facilitates unauthorized memory access from shader code.

EverOS before version 1.0.1 is vulnerable to path traversal in the POST /api/v1/memory/add endpoint. The sender_id field was not validated as a path-safe identifier, allowing an unauthenticated attacker to write or overwrite .md files outside the intended memory directory.

Misskey prior to version 2026.6.0 contains a vulnerability in TOTP authentication where insufficient validation of used tokens allows reuse of a single-use code within its valid time step. An attacker who obtains both credentials and a TOTP code can reuse it for unauthorized actions, potentially leading to account takeover.

RabbitMQ before version 4.2.6 does not enforce the configured stream frame-size limit while assembling frames during authentication and before Tune negotiation. This allows an unauthenticated remote client to declare oversized frame lengths and consume broker memory in rabbit_stream_core.

A vulnerability in RabbitMQ before versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6 allows unauthenticated attackers to read the OAuth 2 client secret via the obsolete GET /api/auth endpoint. This occurs when the management plugin and management.oauth_client_secret are enabled.

RabbitMQ before versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6 allows foreign bindings to amq.rabbitmq.reply-to destinations. The vulnerability is due to missing deletion checks for volatile direct-reply-to queues in Khepri, leaving persistent route entries after unbind.

RabbitMQ before versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5 has a vulnerability in the rabbitmq_management HTTP API that accepts oversized valid JSON bodies on with_decode and direct_request paths. The issue is due to incorrect size checking in read_complete_body, which checks the size before the final chunk but not the final combined size.

A vulnerability in OpenReplay allows an authenticated low-privilege user to read the first 15 seconds of session replay data from another tenant. The issue stems from missing validation that the session belongs to the project when generating presigned download URLs.

In OpenReplay versions 1.27.0 and earlier, three mutation functions (notes.delete, dashboards.update_widget, dashboards.remove_widget) did not check resource ownership, allowing any authenticated user to delete other users' private session notes and modify widgets on their private dashboards.