CVE Vulnerability Catalog

A vulnerability in Elysia prior to version 1.4.29 causes quadratic CPU workload growth when processing multipart/form-data with many unique key-value pairs. The use of getAll in data normalization leads to CPU exhaustion.

A vulnerability in the Plate rich-text editor (versions 53.0.0 to 53.1.4) allows JavaScript injection via embedded media. An attacker can craft a document that, when opened by a victim, renders an iframe with JavaScript code instead of a safe video source.

The py7zr library prior to version 1.1.3 contains a denial-of-service vulnerability causing excessive CPU consumption during SevenZipFile initialization. The PackInfo._read() function in archiveinfo.py uses an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to trigger CPU exhaustion.

The py7zr library before version 1.1.3 does not track the total decompressed size, allowing a decompression bomb attack. A crafted .7z file (e.g., 15.6 KB) can expand to 100 MB, exhausting disk space or memory.

A vulnerability in AsyncSSH prior to version 2.23.1 allows a malicious SSH server to write arbitrary files on the SCP client's filesystem. This occurs because _parse_cd_args in scp.py returns server-provided filenames verbatim and _recv_files joins them to the destination path without enforcing the target directory boundary, enabling ../ traversal sequences.

JupyterLab Git prior to version 0.54.0 uses fnmatch.fnmatchcase() in GitHandler.prepare() to enforce excluded_paths. An authenticated user on a case-insensitive filesystem can vary URL path casing and read excluded directories.

A vulnerability in the libp2p JavaScript library prior to version 16.0.0 allowed blocking the Node.js event loop by sending specially crafted IHAVE and IWANT messages. Missing limits in defaultDecodeRpcLimits (maxIhaveMessageIDs and maxIwantMessageIDs set to Infinity) enabled iterating approximately 180,000 message IDs per 4 MB frame, leading to denial of service (DoS).

In OpenCTI prior to version 7.260326.0, an authorization bypass vulnerability allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header. This enables attackers to downgrade confidence levels, remove security markings like TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports.

The DBS Etherwatch file parser in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 crashes, allowing an attacker to cause a denial of service (DoS).

A vulnerability in GitLab CE/EE due to improper sanitization of user-supplied input allows an authenticated user to execute arbitrary scripts in another user's browser session under certain conditions. Affected versions: all from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2.

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.

A vulnerability in Bitwarden Server before 2026.6.0 allows a low-privileged organization member to obtain another user's vault key and access token. The attacker creates a Trusted Device Encryption authentication request bound to their own public key, and once approved by the victim, the data is readable from an unauthenticated endpoint, leading to account takeover.

A vulnerability in the Composer dependency manager for PHP allows an attacker to write files outside the vendor directory and project during package installation or update. The issue occurs when a package from an untrusted repository (other than Packagist.org or Private Packagist) uses an invalid name that is not properly validated before dependency-resolution results are written.

The httplib2 Python library before version 0.32.0 does not limit decompression of HTTP responses with gzip or deflate encoding, allowing a malicious server to send a small compressed payload that expands to an arbitrarily large size in memory, causing MemoryError or OOM-kill in the client process.

In pypdf library prior to version 6.14.1, a vulnerability was found causing an infinite loop when processing inline images in PDF page content streams. An attacker can craft a malicious PDF with a not terminated inline image, leading to a hang during text extraction.

The pypdf library prior to version 6.14.2 is vulnerable to a DoS attack due to an infinite loop when parsing PDF files. An attacker can craft a malicious PDF with a not terminated inline image using ASCII85 or ASCIIHex filters, causing the process to hang.

LiteLLM prior to version 1.82.0-stable did not apply proper sandboxing and validation for Custom Code Guardrails during creation and update, allowing a privileged user to execute arbitrary Python code in the proxy environment and potentially expose process secrets.

A vulnerability in Gradio before version 6.20.0 allows open redirect and server-side request forgery (SSRF) via unvalidated URLs in the file_fetch() function at the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response to access internal endpoints such as cloud metadata services to steal sensitive credentials, including EC2 IAM role credentials.

A denial-of-service vulnerability in rpcx through version 1.9.3 allows an unauthenticated attacker to send a small gzip-compressed message that decompresses to gigabytes, causing out-of-memory conditions and service unavailability. The issue is in protocol.Message.Decode, where decompressed size is not limited, and the MaxMessageLength check only applies to the compressed frame size.