CVE Vulnerability Catalog

Grist prior to version 1.7.15 contained two cross-site scripting vulnerabilities where an attacker-controlled value reached a link's href without scheme validation, allowing JavaScript execution in the victim's context on a single click. On the account-selection page, the next parameter was used as the link target, and in document tours, the GristDocTour table's Link_URL column became a clickable button, enabling an editor to store a malicious URL.

Grist is spreadsheet software using Python as its formula language. Prior to version 1.7.15, several server-rendered pages embedded user-controlled values without proper escaping, leading to cross-site scripting. On the main page, a document's name or description set by an editor is rendered for other users. On the OAuth2 end-of-flow page, the openerOrigin parameter is reflected back.

A vulnerability in the LangChain4j Java library allows SQL injection via crafted metadata keys in queries to MariaDB and pgvector databases. Insufficient escaping enables arbitrary SQL execution, leading to data exfiltration, denial of service, or row deletion.

In OpenResty from version 1.29.2.1 to before 1.29.2.5, an out-of-bounds write vulnerability exists in the upstream PROXY protocol v2 implementation. An attacker can cause the worker process to crash, leading to a denial of service (DoS). Only configurations with explicitly enabled PROXY protocol v2 for upstream connections are affected.

A vulnerability in Gotenberg prior to version 8.34.0 allows blind SSRF and limited local file disclosure via a specially crafted document sent to the /forms/libreoffice/convert endpoint. LibreOffice automatically retrieves external HTTP(S) resources and local files during document conversion.

A vulnerability in the h2o HTTP server prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 causes a crash when processing QPACK instructions over HTTP/3. The function in lib/http3/qpack.c allocates an on-stack buffer of approximately 800 KB using alloca, exceeding the default pthread stack size in musl libc and leading to a segmentation fault.

A vulnerability in kernel software running inside a Host VM allows sending improper commands to GPU firmware, potentially causing a memory write outside the allowed range for the host kernel. Additionally, a TOCTOU bug exists where a malicious driver can modify values in memory after firmware validation but before use.

A vulnerability in kernel software running inside a Host VM allows sending improper commands to GPU firmware, leading to unauthorized GPU register access and privilege escalation.

A vulnerability in the sparse memory implementation of GPU drivers allows out-of-bounds (OOB) kernel memory reads or writes. The flaw occurs when indexing pages larger than 4 kB in the page freeing logic, leading to incorrect buffer access.

A vulnerability in GPU software allows a non-privileged user to perform improper GPU system calls, causing an integer overflow and mapping two GPU virtual addresses to the same physical address. After one virtual mapping is freed, the physical page can be reallocated, and the second mapping enables access to freed memory (use-after-free).

RustDesk before version 1.4.9 does not enforce the authorized connection scope of a session on the server side. An authenticated remote peer with a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session.

In FreeRDP prior to version 3.27.1, when using the /cache:codec:rfx option, clients pass incorrect dimensions to RemoteFX decoding, allowing a malicious RDP server to trigger a heap out-of-bounds write with attacker-controlled offset and content.

Logto before version 1.41.0 has an XML injection vulnerability in SAML, where user-controlled profile attributes (e.g., name, email) are substituted into a SAML template without proper escaping. An authenticated low-privilege user can inject XML markup into a profile attribute, forging SAML attributes like role, leading to privilege escalation in relying service providers.

Snipe-IT prior to version 8.6.2 has a vulnerability due to insufficient sanitization of uploaded SVG files. A low-privilege user can upload active XHTML or XML content that is later served same-origin and executes JavaScript in a viewer's browser.

Snipe-IT prior to 8.5.0 stores the User-Agent header from requests in the action log and writes it to the Activity Report CSV without formula escaping. This allows a low-privileged authenticated user to inject a malicious formula that may execute when the CSV is opened in spreadsheet software.

Logto prior to version 1.41.0 has a vulnerability in the step-up verification mechanism in Account Center. An attacker with an API token can create and verify a WebAuthn registration for a new passkey, then use it as identity verification, allowing MFA factor management without possessing a password, identifier, or existing MFA factor.

An authorization bypass vulnerability in TeraMIS allows privilege abuse through a user-controlled key. Affected versions range from V03.26.01.14 through 30.04.2026.

A SQL injection vulnerability in Dify before version 1.16.0-rc1 in the MyScale vector store backend allows attackers to execute arbitrary SQL by supplying unsanitized search parameters to the search_by_full_text method without escaping or parameterization. Attackers can inject malicious SQL through the search parameters to read, modify, or delete data in the underlying ClickHouse database.

Krayin CRM up to version 2.2.3 contains an insecure direct object reference (IDOR) vulnerability in LeadController, PersonController, OrganizationController, QuoteController, and ActivityController. It allows authenticated users to edit, update, or delete records owned by other users.

A vulnerability in Snipe-IT prior to version 8.6.2 allows an authorized user to move a maintenance record to an asset outside their company scope. This occurs because PATCH or PUT requests to /api/v1/maintenances/{maintenance_id} do not re-authorize the newly supplied asset_id.