CVE Vulnerability Catalog

A vulnerability in the hex package manager allows the package owner or an attacker who has taken over the owner's account to publish a new release bypassing the release-age cooldown. The cooldown mechanism that blocks too-fresh versions can be bypassed by retiring the currently locked version, causing the next update to select the new version regardless of its age. Affects hex from 2.5.0 before 2.5.2.

A vulnerability in rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when dependencies are fetched. The app field in Hex dependencies is used without validation as a directory name, enabling paths like ../../../../target. Affects rebar3 from 3.7.0-rc1 before 3.27.2.

JAXB factory methods rely solely on FEATURE_SECURE_PROCESSING to prevent XML External Entity (XXE) resolution. On JAXP implementations where that feature alone does not block external entity resolution, an attacker can read local files via out-of-band XXE.

A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker running a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress, leading to use of freed memory and potentially crashing the GNOME session or arbitrary code execution in the compositor.

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The item_name parameter does not sanitize directory traversal sequences, allowing an authenticated user with UPDATE-level permissions to write files outside the expected templates directory, including web-accessible paths. Additionally, the translation-writing logic does not escape backslashes, allowing inputs to break out of PHP string literals and inject executable code. Chained together, these flaws allow a malicious PHP file to be written to a web-accessible path and executed with web-server privileges.

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation relying solely on client-supplied MIME types. An administrator can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the server.

In Thelia v2.6.0, the document update endpoint does not perform the same validation as the upload endpoint, which blocks executable file types. An attacker with administrative Thelia permissions can exploit this to upload arbitrary executable files, such as malicious PHP scripts, achieving remote code execution.

OS command injection vulnerability in UYAP Document Editor before version 5.4.20 on Windows and Linux and before 5.4.21 on iOS. Improper neutralization of special elements allows execution of arbitrary system commands.

Deserialization of untrusted data vulnerability in UYAP Document Editor on Windows, Linux, and MacOS before versions 5.4.20/5.4.21 allows Object Injection.

SGLang through 0.5.21 contains a denial of service vulnerability that disables Pillow decompression bomb protection by setting Image.MAX_IMAGE_PIXELS to None in NanoNemotronVLImageProcessor. Remote attackers can submit small, highly compressed images with huge dimensions, exhausting worker memory during decoding.

SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits by supplying fps, max_frames, max_tokens_per_frame and max_image_tokens in the video_url object. Attackers can set these values arbitrarily high so glm4v.py decodes every frame of high-resolution video at full size, exhausting worker memory and denying service.

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full source resolution before applying max_pixels limits. Remote attackers can submit high-resolution videos to /v1/chat/completions on Qwen-VL deployments, and concurrent requests exhaust worker memory causing denial of service.

SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by submitting highly compressed audio decoded without duration or sample limits. Attackers can supply small FLAC-encoded silence files through audio_url or audio_data inputs that expand into massive PCM buffers, exhausting worker memory and CPU for denial of service.

SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service.

LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk without a session. Attackers can repeatedly send multipart requests with unlimited file parts to /upload, persisting files in uncleaned temporary directories and exhausting server disk space.

LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink, or restore via SOAP or /services/rest/document with sequential document IDs to disclose, delete, or tamper with documents.

LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity templates in DocumentService.sendAsEmail subject or message fields. Attackers can invoke SystemTool exec methods or ClassTool, bypassing the forbidRuntimeUsage denylist, to run commands with LogicalDOC process privileges.

In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable.

A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.

jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields including tenant_id and password. Attackers can send a crafted PUT /user/update body to switch into another tenant on next login or overwrite other users' password hashes for account takeover.