CVE Vulnerability Catalog

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify that same artifact. When global OCI signature verification was enabled via `OCI_TRUST_POLICY` (`enabled: true`), an attacker with write access to the configured OCI tag could publish an unsigned or improperly signed artifact containing `.doco-cd.yml` with `oci.verify: false`, causing signature verification to be bypassed and untrusted deployment content to be applied.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read.

libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes.

Hoverfly prior to version 1.12.8 uses http.DefaultClient without any timeout configuration for remote post-serve actions. When the remote endpoint is unreachable or intentionally slow, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do().

Hoverfly is an open source API simulation tool. Prior to version 1.12.8, when Hoverfly is running in Diff mode, the AddDiff() function writes to the shared responsesDiff map without any synchronization (no mutex). When multiple proxy requests are processed concurrently, the concurrent map writes trigger Go's built-in race detector which causes a fatal error: concurrent map read and map write, immediately killing the entire Hoverfly process.

Kimai versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target object to that team.

libks provides foundational support for signalwire C products. Prior to version 2.0.11, clean_uri() in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path.

OpenTelemetry eBPF Profiler starting in version 0.0.202527 and prior to version 0.0.202622 allows an unprivileged process to cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service.

matrix-sdk-crypto starting in version 0.12.0 and prior to version 0.17.0 was missing a check for the user ID when decrypting an Olm-encrypted event containing the sender_device_keys property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator.

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts.

Concrete CMS below 9.5.3 is vulnerable to stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload that executes in the browser of any visitor viewing a page where the block displays a date-type attribute.

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block. A user with permission to edit file properties could store a script payload that executes in the browser of any visitor to a page displaying the block with the description or tags column enabled, including unauthenticated visitors.

Concrete CMS 9.5.2 and below is vulnerable to CSRF in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforce a failed CSRF token check. A remote unauthenticated attacker can force an authenticated administrator visiting an attacker-controlled page to permanently delete all entries of an attacker-selected Express entity.

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which for file-referencing blocks (e.g., hero_image, gallery) is where the referenced file is authorized against the user's file-manager visibility. This allowed an authenticated user with block-add scope to store and render a reference to a file that would otherwise be rejected, disclosing its URL and preview.

Apko and melange verified only the control section hash (e.g. .PKGINFO) against the signed APKINDEX, but never verified the data section hash, i.e. the actual package files. An attacker able to compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.

In Shelf, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation can be bypassed via image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains, resulting in a Server-Side Request Forgery (SSRF) vulnerability. Additionally, response bodies are fully buffered before size validation, creating a memory exhaustion vector.

Dobase versions prior to 2026.06.03 have a one-click stored DOM-based XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and never sanitized, allowing execution of malicious code in the browser of anyone with the public share link.

Mousehole prior to version 0.4.05 has its HTTP/WebSocket management boundary reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse (MAM) session cookie and reuses the same cookie-bearing serialization for state, API responses, and WebSocket updates, allowing any client reaching the port to read state, replace the cookie, or force MAM update side effects.

Kimai versions prior to 2.58.0 contain a server-side request forgery vulnerability in the invoice PDF preview and generation workflow. If an attacker controls Markdown content rendered into an invoice PDF, such as Customer.invoiceText, the server-side PDF renderer fetches remote image URLs embedded in Markdown, allowing outbound requests to attacker-controlled or internal targets.

The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL mutation. An authenticated user who knows or guesses another user's task ID can read its form data, overwrite its submitted data, and mark the task as completed.