CVE Vulnerability Catalog

Inngest versions 3.22.0 through 3.53.1 allow unauthenticated remote attackers to exfiltrate host process environment variables via the serve() HTTP handler. PATCH, OPTIONS, or DELETE requests fall through to a generic handler returning diagnostic information that includes process.env. The issue is fixed in version 3.54.0.

A malicious module proxy can exploit a flaw in the go command's validation of module checksums to bypass checksum database validation. This affects users using untrusted module proxies or checksum databases.

Specially crafted input can cause a denial of service (DoS) through the consumePhrase function when parsing an email address according to RFC 5322.

Budibase to otwartoźródłowa platforma low-code. W wersjach przed 3.35.10, ciasteczko budibase:auth zawierające token sesji JWT jest ustawione z httpOnly: false, co pozwala na odczytanie go przez JavaScript, co prowadzi do pełnego przejęcia konta w przypadku ataku XSS.

The Dial and LookupPort functions panic on Windows when provided with input containing a NUL (0) character. This can cause applications processing untrusted input to crash.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate functions can trigger excessive CPU exhaustion and memory allocations.

When processing HTTP/2 SETTINGS frames, the transport enters an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

A vulnerability in the cgo DNS resolver in Go (when using LookupCNAME) causes a double-free of C memory and a crash when handling a very long CNAME response.

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0 affecting an unknown part of the file /ajax.php?action=save_user. Manipulation of the argument ID results in SQL injection.

Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.

GitPython is a Python library used to interact with Git repositories. In versions prior to 3.1.49, the GitConfigParser.set_value() method did not validate values for newlines, allowing for the injection of malicious paths into Git configuration.

GitPython is a Python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability allowed attackers to manipulate files outside the repository's .git directory due to insufficient validation of reference paths.

GitPython is a Python library used to interact with Git repositories. In versions prior to 3.1.47, the _clone() function improperly validates multi_options, allowing malicious hooks to be executed during repository cloning.

GitPython is a Python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, the library blocks dangerous Git options, but equivalent Python kwargs can bypass that check, leading to arbitrary command execution.

Notepad Next prior to version 0.14 had a detectLanguageFromExtension() function that interpolated a file's extension without sanitization, allowing attackers to inject Lua code. When such a file is opened in NotepadNext, the malicious code is executed automatically.

FreeScout is a free help desk and shared inbox built with the Laravel framework. Prior to version 1.8.214, the Change Customer modal correctly hides out-of-scope customers, but the backend conversation_change_customer action accepts any supplied customer_email.

FreeScout prior to version 1.8.217 had a vulnerability in the Helper::sanitizeRemoteUrl() function that improperly validated URLs after HTTP redirects. An attacker could exploit this vulnerability to redirect traffic to internal HTTP services that would normally be blocked.

FreeScout prior to version 1.8.217 allows users with updateAutoReply permission to store an XSS payload in the auto-reply message. The payload is rendered unescaped in the auto-reply email sent to customers.

In BentoPDF, prior to version 2.8.3, a cross-site scripting (XSS) vulnerability was identified. An attacker could execute arbitrary JavaScript under certain circumstances in the Markdown to PDF Tool.

A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates.