CVE Vulnerability Catalog

Prior to version 7.2.0, Semantic MediaWiki's Special:URIResolver redirects to a URL derived from the subpage without validating the target, allowing an open redirect to an off-host destination, potentially embedding credentials.

Prior to version 7.2.0, Semantic MediaWiki reflects the 'value' parameter in rendered output and error messaging paths without sufficient output-context encoding, allowing reflected XSS.

Prior to version 7.2.0, Semantic MediaWiki inserts the separator (parameter 'sep') verbatim into HTML cell joins, allowing HTML injection and potentially XSS.

Prior to version 7.2.0, when headers=plain is set, Semantic MediaWiki emits table header text into <th> via a raw HTML path. User-controlled 'mainlabel' content can become executable HTML.

Process Compose before version 1.120.0 has a vulnerability in the MCP SSE listener that accepts browser-origin requests without validating Host/Origin headers or authenticating the caller. A malicious website can use DNS rebinding to reach the loopback listener and issue MCP requests, potentially allowing process enumeration, log access, and process control if expose_control_tools is enabled. Fixed in version 1.120.0.

A vulnerability in the adm-zip library (JavaScript) prior to 0.6.1 affects getData() in zipEntry.js, which trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing excessive memory consumption before CRC validation reports an error. Applications reading entries from untrusted archives can be terminated by the OS or suffer memory exhaustion.

WACRM 0.7.0 and earlier has vulnerabilities: row-level security policies allow authenticated users to modify their own role and account ID, enabling privilege escalation and cross-tenant movement. Additionally, match_ai_knowledge_fts and match_ai_knowledge_semantic run as SECURITY DEFINER with no account membership check, allowing non-members to read another tenant's knowledge chunks.

A vulnerability in WACRM (self-hostable CRM template for WhatsApp) in version 0.7.0 and earlier affects flow and automation write routes that authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. A viewer can create, edit, activate, or delete flows and create active automations and trigger outbound WhatsApp actions without the required role.

In NanoMQ MQTT broker prior to 0.24.14, the nmq_subinfo_decode() function reuses the length variable from the outer Properties Length while parsing each subscription identifier. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing a read beyond the heap message buffer. The issue is fixed in version 0.24.14.

AnyCable before version 1.6.15 has a vulnerability in the telemetry subsystem that uses a hardcoded public auth token and generates a stable fingerprint from sensitive configuration data. Although raw credentials are not shown to leave the process, the fingerprint could be used for instance identification. Fixed in version 1.6.15.

AnyCable before version 1.6.15 has a vulnerability in the Pusher-compatible REST API where the body_md5 value is included in HMAC but not verified against the actual request body. An attacker with a valid signed POST request can replace the body, and the lack of auth_timestamp freshness check allows replay attacks. This can lead to forged server events, state modification, or delivering attacker-controlled messages to WebSocket clients. Fixed in version 1.6.15.

In AnyIO 4.14.0, open_process() forwards the group argument to the backend instead of extra_groups, despite accepting the extra_groups parameter. A call with extra_groups=[] to clear inherited supplementary groups can launch a child process that retains the parent's groups, weakening a privilege-dropping boundary. This affects POSIX applications using AnyIO subprocess helpers and is fixed in version 4.14.2.

In btrbk from 0.29.0 until 0.32.7, the ssh_filter_btrbk.sh script constructs allow_stream_match with a start anchor but no end-of-string anchor for the full command. A user restricted via an authorized_keys forced command can append a trailing pipe command after a valid btrbk prefix, bypassing the allowlist and executing arbitrary commands with the backup-target SSH account's privileges. This is fixed in version 0.32.7.

In zot registry prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the DistSpecAuthzHandler path, and DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a token limited to pull and push can delete manifests and blobs within the token's repository scope. This is fixed in version 2.1.18.

Capsule from version 0.13.0 to 0.13.7 has a vulnerability in the Tenant validation webhook where the new and old parameters are reversed, causing validation of the previous AllowedHostnames.Regex instead of the submitted value. A cluster administrator can store a malformed regex, which later blocks Ingress operations for the tenant. Fixed in version 0.13.7.

Capsule from version 0.13.0 to 0.13.7 has a vulnerability in Tenant update validation where ForbiddenLabels.Regex is compiled for both labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator can persist a malformed regex, which later causes regexp.MustCompile to panic during metadata validation and blocks namespace operations. Fixed in version 0.13.7.

In Capsule prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When the forbidden list mixes capitalized and lowercase keys, the binary search can return false for a key that is present. An authenticated tenant owner can bypass configured namespace, Service, or delegated node metadata restrictions. This is fixed in version 0.13.7.

A vulnerability in NanoMQ before 0.24.14 in the client function nni_mqtt_msg_decode_unsubscribe() fails to handle a failed read while counting topics in a malformed UNSUBSCRIBE packet. This can hang a connecting MQTT 3.1.1 client, consume CPU and memory, and repeatedly deny service when auto-reconnect is enabled.

In Rsyslog from 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a parameter larger than the buffer, causing an attacker-controlled stack overwrite. This is fixed in version 8.2606.0.

In ToolHive prior to CLI 0.30.1 and Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while ToolHive API and MCP proxy endpoints are reachable without authentication. A malicious or compromised MCP server can use the Docker gateway to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane without escaping the container. This is fixed in CLI 0.30.1 and Studio 0.38.0.