CVE Vulnerability Catalog

Pimcore before versions 11.5.19, 12.3.10, and 2026.1.6 allows an authenticated user with reports_config permission to inject SQL fragments into report configuration fields. Executing the report can disclose, modify, or delete arbitrary database data.

hashi-vault-js prior to 0.5.2 passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while retaining AxiosError.config and the equivalent response configuration. These objects can contain the X-Vault-Token request header and err.config.data request body, including submitted passwords or secret values. When a consuming application records the caught exception through logging or monitoring, the live Vault token and request secrets can be stored in plaintext.

In WeasyPrint prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim.

Pimcore before version 2026.1.5 allows an authenticated user with objects permission to submit a malicious ClassDefinition UID that is used in SQL queries without proper quoting. This can lead to reading or modifying arbitrary database tables, including disclosure of password hashes.

In the safeurl library prior to 0.2.4, the privateNetworks list in ip.go omits the IPv6 ranges 64:ff9b:1::/48, 5f00::/16, 3fff::/20, and 100:0:0:1::/64. When an application enables IPv6 via EnableIPv6(true), an attacker-controlled destination in one of these ranges is not recognized as non-public and can pass the SSRF destination check. IPv6 is disabled by default, so configurations with EnableIPv6(false) are not exposed.

node-opcua before version 2.166.0 stores nonces in a global cache without expiration or size limit. An unauthenticated attacker can repeatedly create sessions with unique nonces, causing unbounded heap growth and crashing the server.

node-opcua before version 2.166.0 in UserNameIdentityToken handling does not verify that trailing bytes match the current serverNonce. This allows an attacker to forge a token with an empty password or replay a captured token in another session.

ExifReader before version 4.40.1 has a vulnerability in the ISO-BMFF parser where findMetaBox() and parseBox() do not confirm that required fields remain in the DataView. Specially crafted HEIC or AVIF data can lead to an unchecked full-box version read or reading absent size fields, causing a RangeError that can abort an application request or worker.

The vulnerabilities tracked by CVE-2026-20353 relate to improper control of a resource through its lifetime grouped under CWE Pillar CWE-664 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.

The Zephyr SDIO subsystem has a vulnerability in sdio_io_rw_extended_helper() where func->cis.max_blk_size is decoded from the SDIO card without validation. If a card reports a maximum block size of zero, the transfer loop never terminates, causing a thread hang and permanent mutex lock, leading to denial of service for the SDIO peripheral.

A flaw was found in sssd where a local unprivileged user can send a specially crafted request with a zero-length body to the NSS responder. This can lead to instability or termination of the NSS responder, causing denial of service.

A flaw was found in SSSD where a local attacker with privileges to connect to the PAM responder socket can send a specially crafted protocol request. If `pam_app_services` is enabled and the service item is omitted, a NULL pointer dereference can occur, crashing the PAM responder and disrupting authentication services.

A flaw was found in sssd in the PAM responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body, triggering an out-of-bounds read that may cause the PAM responder to terminate or restart, leading to a local denial of service.

GIMP when processing a specially crafted lighting preset file does not properly validate the number of light sources in the Lighting Effects filter. This can lead to an out-of-bounds write, potentially causing a crash or enabling arbitrary code execution.

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Scripts execute in the browsers of other users, including administrators.

A vulnerability was found in itsourcecode Loan Management System 1.0 in the file navbar.php, where manipulation of the argument page can lead to cross site scripting (XSS). The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in GPAC up to f1219cde in the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the MP4Box component. Manipulation leads to use after free. The attack can be initiated remotely, and the exploit has been made public. Upgrading to version abi-16.23 fixes the issue.

A vulnerability was found in GPAC up to f1219cde in the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the MP4Box component. Manipulation leads to use after free. The attack may be performed remotely, and the exploit has been disclosed. Upgrading to version abi-16.23 is recommended.

A flaw has been found in GPAC up to f1219cde in the function gf_node_list_get_child of the file scenegraph/base_scenegraph.c of the MP4Box component. Manipulation of the argument Target causes null pointer dereference. The attack can be carried out remotely, and the exploit has been published. Upgrading to version abi-16.23 addresses the issue.

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This may lead to a denial of service by crashing the NSS responder process.