CVE Vulnerability Catalog

Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.

Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses. A comment closed immediately before a non-break character causes the tokenizer to concatenate the atoms surrounding the comment, so an address like [email protected](x)evil.com is read as the domain good-corp.comevil.com. This can lead to delivery to an attacker-controlled domain. Fixed in 9.1.0.

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.

Nodemailer versions 9.1.0 and earlier do not honor the disableFileAccess and disableUrlAccess sandbox options when message content is resolved through the public plugin API MailMessage.resolveContent() using the legacy three-argument signature. As a result, plugin or application code can be induced to read arbitrary local files or issue outbound HTTP(S) requests (SSRF), bypassing the enabled sandbox. Fixed in 9.1.1.

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorizes the GraphQL draftCreator and revisionCreator fields. Instead of requiring the user-data scope enforced by Gql::canQueryUsers(), these fields are gated only on elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element without per-field authorization. A client with only those scopes can harvest email addresses, usernames, full names, and postal addresses of all draft/revision creators. Fixed in 5.11.0.

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml(). Because Craft/Yii HMAC tokens are not bound to a parameter name, an authenticated low-privilege control panel user with edit rights on a single element type can mint a token over attacker-controlled Twig for the returnUrl parameter and replay it as the redirect POST parameter, reaching the unsandboxed sink and achieving server-side template injection that executes arbitrary PHP code. The issue is fixed in 5.10.13.

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose. An authenticated, non-administrator user can set the cookie via the license-shun endpoint and transplant the signed envelope into the redirect parameter; on a successful login, Craft validates the signature and renders the authenticated bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and allows PHP system() to execute arbitrary operating-system commands as the web-server user. Exploitation requires an account using password authentication without active 2FA, the default request configuration, and availability of PHP system(). The issue is fixed in 4.18.6 and 5.10.13.

Craft CMS versions 5.0.0 through 5.10.12 treat a database connection failure as meaning Craft is not installed, making anonymous installer actions (including install/validate-site) reachable on an installed production site when PHP remains available but MySQL is not. An authenticated attacker with a valid guest session and CSRF token can read environment variables, including the security key, database credentials, or API keys. Fixed in 5.10.13.

Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disables Twig autoescaping and fails to encode cached values. Content editors can inject malicious JavaScript through editable fields that executes in authenticated Control Panel sessions of higher-privileged users. Fixed in 5.10.13.

Craft CMS 5.0.0 through 5.10.12 contains a broken access control flaw in the nested-elements reorder endpoint. An authenticated user with view-only permissions can reorder Matrix blocks or Address fields in another author's content without save access.

n8n before versions 1.123.76, 2.37.7, and 2.38.2 has a vulnerability in the source control push endpoint that allows an authenticated project user to delete files (workflows and credentials) from projects they do not have access to. Exploitation requires the Source Control (Environments) enterprise feature to be enabled.

n8n before versions 1.123.76, 2.37.7, and 2.38.2 has a vulnerability in the Git node that allows an authenticated user to read Git repositories outside the configured directory (N8N_RESTRICT_FILE_ACCESS_TO). By nesting the repository below the configured path, the user can bypass the URL validation and git actually reads data from outside the allowed area.

AVideo through version 29.0 fails to verify video access permissions in the set_api_comment function, allowing authenticated users to post comments on password-protected and group-restricted videos. Attackers can send POST requests to the comment API endpoint with arbitrary video IDs.

AVideo through version 29.0 fails to validate video access permissions in the API like endpoint, allowing logged-in users to vote on password-protected and group-restricted videos. Attackers can send like and dislike requests to increment vote counters on videos they cannot watch.

AVideo through version 29.0 contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endpoint writes the attacker's User-Agent directly into the database, and it is later rendered without escaping on the video owner's and administrator's statistics page, allowing malicious code execution in their sessions.

AVideo through version 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can exceed the 30-attempts-per-5-minutes login limit by an arbitrary factor.

AVideo (WWBN/AVideo) through version 29.0 is vulnerable to cross-site request forgery (CSRF). The CSRF protection mechanism is disabled when 'user' and 'pass' parameters are present in the request, but their values are not validated. An attacker can exploit this to modify video records, including ownership transfer, removal of access restrictions, and other changes.

In AVideo through version 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters to drive video like counts arbitrarily negative, with the corruption persisting until manual repair.

The CloneSite plugin in AVideo through version 29.0 contains a stored OS command injection vulnerability. The stored SSH password is substituted into the command `sshpass -p '{password}' rsync ...` using plain str_replace without escaping, allowing a single quote to break out and inject arbitrary shell commands. Exploitation requires luring an authenticated administrator into planting a malicious password via a CSRF vector, followed by execution via the documented crontab entry.

In AVideo through version 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, allowing plugin files matching core filenames to inherit CSRF exemptions. The LoginWordPress plugin file login.json.php inherits an exemption and unconditionally logs out authenticated users on cross-site POST requests before validating credentials.