CVE Vulnerability Catalog

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write note share link can disclose an uploaded file or image from the same project by updating the shared note to reference the target asset filename. The user-controlled reference causes the shared-note authorization logic to treat the asset as permitted, after which the attacker can download it. The attacker must know the asset filename, and the issue does not permit cross-project access. This issue is fixed in version 2026.68.

SysReptor prior to 2026.68 does not rotate the session identifier after successful password authentication for protected shared notes, allowing session fixation. An attacker can reuse the fixed session after the victim authenticates to the shared note. The main SysReptor login flow is not affected.

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload image files whose formats cause image processing to invoke Ghostscript, allowing embedded PostScript to operate in the shared temporary directory. An attacker can combine that behavior with a race involving GnuPG configuration files in temporary subdirectories to cause GnuPG to copy attacker-controlled Python code into the application code directory.

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while configuring ALLOWED_HOSTS with a wildcard accept an attacker-controlled Host header when generating a password reset link. An unauthenticated attacker can request a reset email whose link points to an attacker-controlled system, and a victim who follows that link can disclose the reset token.

SysReptor prior to 2026.55 discloses project-wide collaborative editing metadata to an unauthenticated holder of a public note share link. The metadata can reveal usernames, note identifiers, and live editing activity of notes that were not shared. The content of non-shared notes remains protected, and the issue does not grant write access.

PJSIP is a free and open source multimedia communication library written in C. In 2.17 and earlier, the PJSIP AVI parser in pjmedia/src/pjmedia/avi_player.c uses an input-file video chunk length as the number of bytes copied into a frame buffer whose capacity is derived from the declared media dimensions. A crafted AVI file can therefore cause an attacker-controlled out-of-bounds write past the heap allocation when an application plays the file or pulls its frames. The existing size assertion does not protect production release builds, where assertions are disabled. Typical local playback can crash the process, while applications that accept untrusted AVI sources expose a stronger memory-corruption condition. No fixed version is available as of this review.

Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, an unauthenticated attacker could initiate the OIDC login flow with an attacker-controlled redirectUrl. The login handling in auth/oidc.go stored that URL with the opaque login state, and /auth/oidc/logged/{provider} appended the provider, token, and error values before redirecting the victim's browser without validating the destination. Because the one-use token was not bound to the browser session that initiated login, an attacker who induced a victim to complete OIDC authentication could capture the token at the attacker-controlled destination and exchange it through /auth/oidc/callback/{provider} for the victim's Kyoo session. This issue is fixed in version 5.1.0.

In Kyoo media server prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. Path handling only checked the Settings.SafePath prefix and did not verify a Kyoo catalog record, allowing retrieval of hidden, temporary, or uncataloged files under the media directory when the path was known or guessed.

In Paymenter prior to 1.5.7, doUpgrade() relied on Service::upgradable to check for a pending upgrade and then incremented credit without a DB transaction or lock. An authenticated customer with an active downgradable service could submit concurrent downgrade requests, creating multiple upgrade records and incrementing the same credit balance multiple times.

In c-ares prior to 1.34.7, ares_dns_parse() trusted attacker-controlled ANCOUNT, NSCOUNT, and ARCOUNT fields before confirming the DNS response contained enough bytes. A malicious DNS response could cause disproportionate heap allocation for a tiny message, degrading or denying name resolution.

c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not bound the total pointer hops or assembled name length. A malicious DNS server can send a response containing a long descending pointer chain and many resource records whose NAME or RDATA fields refer to the chain, causing repeated decompression work that grows quadratically with message size.

In AnyIO prior to 4.14.2, process-pool workers were started with stderr connected to a pipe the parent never drained. Worker code writing enough data to sys.stderr could fill the pipe and block before returning the response, causing the awaiting process-pool call to remain blocked indefinitely.

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including /api/v1/projects/{project}/dashboards and /api/v1/datasources. The request-controlled project value is used to select dashboards, datasources, and variables without enforcing the caller's authorization for that selected project.

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal characters, and the resulting project value is used to select database paths. An authenticated attacker can supply directory traversal segments to leave the intended project directory, read arbitrary YAML or JSON files accessible to the Perses process, and bypass project isolation.

Perses versions 0.43.0 through 0.54.0-rc.0 authorize datasource creation and unsaved datasource proxy paths on a Datasource or GlobalDatasource scope without requiring read permission for the separately grantable associated project or global Secret. A low-privilege user can attach a Secret they cannot read, point the datasource at a user-controlled service, and cause Perses to send the decrypted secret in plaintext, bypassing scope separation.

LubeLogger prior to 1.6.8 allows an authenticated user to submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user can edit. The endpoint authorizes destination vehicles but fetches source records without checking UserCanEditVehicle for each existingRecord.VehicleId, allowing records belonging to another user to be copied into an attacker-controlled vehicle.

LubeLogger prior to 1.6.8 allows authenticated non-administrative users to reach HandleTranslationFileUpload and influence the name passed to RenameFile, which constructs newFilePath without verifying the resolved absolute path remains under the web root or data directory. A crafted upload name can move an uploaded file outside the intended storage directory.

Icinga 2 from 2.4 until 2.14.9, 2.15.4, and 2.16.2 writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, create additional objects, and exceed the user's assigned privileges.

Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2 does not bound JSON nesting depth, allowing deeply nested JSON to exhaust the call stack. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process.

Icinga 2 from 2.8 to 2.14.9, 2.15.4, and 2.16.2 has a vulnerability in certificate update JSON-RPC message handling where the sender is not validated as a trusted endpoint. An unauthenticated attacker with access to TCP port 5665 can replace the node certificate and CA certificate, impersonate a trusted node, and take control.