CVE Vulnerability Catalog

OpenTelemetry eBPF Profiler starting in version 0.0.202527 and prior to version 0.0.202622 allows an unprivileged process to cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service.

matrix-sdk-crypto starting in version 0.12.0 and prior to version 0.17.0 was missing a check for the user ID when decrypting an Olm-encrypted event containing the sender_device_keys property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator.

OpenMRS is an open source electronic medical record system platform. Prior to versions 1.23.0 and 2.10.0, an authenticated user can trigger administrative DWR services. Specifically, the startHl7ArchiveMigration method is accessible, which should be restricted to admin-level accounts.

Concrete CMS below 9.5.3 is vulnerable to stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload that executes in the browser of any visitor viewing a page where the block displays a date-type attribute.

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block. A user with permission to edit file properties could store a script payload that executes in the browser of any visitor to a page displaying the block with the description or tags column enabled, including unauthenticated visitors.

Concrete CMS 9.5.2 and below is vulnerable to CSRF in the Express "Clear Entries" function (POST /index.php/dashboard/system/express/entities/delete_entries) because the controller records but does not enforce a failed CSRF token check. A remote unauthenticated attacker can force an authenticated administrator visiting an attacker-controlled page to permanently delete all entries of an attacker-selected Express entity.

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which for file-referencing blocks (e.g., hero_image, gallery) is where the referenced file is authorized against the user's file-manager visibility. This allowed an authenticated user with block-add scope to store and render a reference to a file that would otherwise be rejected, disclosing its URL and preview.

Apko and melange verified only the control section hash (e.g. .PKGINFO) against the signed APKINDEX, but never verified the data section hash, i.e. the actual package files. An attacker able to compromise a mirror, poison a cache, or MITM a package fetch could substitute arbitrary file contents while the control hash check still passed.

In Shelf, authenticated users with the asset:import permission can trigger server-side HTTP requests to attacker-controlled URLs through the Asset CSV Content Import feature. The imageUrl validation can be bypassed via image-extension suffixes, image-related path keywords, domain substring matching, and redirect chains, resulting in a Server-Side Request Forgery (SSRF) vulnerability. Additionally, response bodies are fully buffered before size validation, creating a memory exhaustion vector.

Dobase versions prior to 2026.06.03 have a one-click stored DOM-based XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and never sanitized, allowing execution of malicious code in the browser of anyone with the public share link.

Mousehole prior to version 0.4.05 has its HTTP/WebSocket management boundary reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse (MAM) session cookie and reuses the same cookie-bearing serialization for state, API responses, and WebSocket updates, allowing any client reaching the port to read state, replace the cookie, or force MAM update side effects.

Kimai versions prior to 2.58.0 contain a server-side request forgery vulnerability in the invoice PDF preview and generation workflow. If an attacker controls Markdown content rendered into an invoice PDF, such as Customer.invoiceText, the server-side PDF renderer fetches remote image URLs embedded in Markdown, allowing outbound requests to attacker-controlled or internal targets.

The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL mutation. An authenticated user who knows or guesses another user's task ID can read its form data, overwrite its submitted data, and mark the task as completed.

OpenRemote prior to version 1.24.1 allows users with only read:assets privileges to write predicted datapoints via the predicted datapoint write endpoint. Version 1.24.1 fixes the issue.

ArduinoCore-avr versions prior to 1.8.8 allow an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino String object. Passing values near the extremes of the float or double range to String::concat(float), String::concat(double), String::operator+=(), or the + operator causes dtostrf() to write beyond the stack buffer, leading to memory corruption and denial of service.

ArduinoBLE versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected.

matrix-sdk-ui prior to 0.17.0 is missing a check in the message edit validation logic: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.

In the Linux kernel, a vulnerability was resolved in drm/amd/display where HDCP configuration was not skipped in the transition state. The transition state does not have a valid dm_stream_ctx, so the HDCP routine should be skipped — it is only valid when a valid stream is created.

A flaw was found in the Linux kernel btrfs subsystem where write-protection of folios during data writeback was lost. A code change replaced folio_clear_dirty_for_io() with a plain folio_test_dirty() check, allowing a process with an mmap-ed file to modify sectors while writeback is in progress. This can cause checksum corruption, lost writes, and data corruption for compressed or inline extents.

In the Linux kernel, a race condition in the ring-buffer during subbuf resize by readers was resolved. trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can simultaneously be resized with ring_buffer_subbuf_order_set(). The fix uses bpage::order instead of trace_buffer::subbuf_size and adds a mutex in ring_buffer_read_start().