CVE Vulnerability Catalog

A vulnerability in the Unraid web server allows remote code execution via command injection in FileUpload.php. The flaw stems from insufficient validation of user-supplied data before use in a system call. Authentication is required, and an attacker can execute code as the www-data user.

In Rocket.Chat versions prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /api/v1/fingerprint endpoint requires authentication but does not perform authorization checks. Any authenticated user could deregister the workspace from Rocket.Chat Cloud, leading to data loss and requiring manual re-registration.

Vulnerability in Rocket.Chat's Apple Sign-In handler lacks JWT claims validation. An attacker who obtains a target user's Apple identity token (from server logs, intercepted sign-in flow, or another app sharing the same Apple developer team) can replay it to authenticate as that user with no expiration.

In Rocket.Chat prior to versions 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, in loginHandler.ts, handleIdentityToken parses a JWT from Apple during OAuth. If the JWT lacks an email, the app accepts an arbitrary email from the request, enabling account takeover.

SiYuan is an open-source personal knowledge management system that prior to version 3.7.0 did not escape untrusted fields (name, version, author, description) when serialized into the data-obj HTML attribute of each marketplace card. As a result, a package containing a single quote could inject arbitrary HTML, escalating from DOM XSS to arbitrary OS command execution.

Appsmith before version 2.1 has a vulnerability due to insufficient IP address filtering in HTTP requests. The host blocking mechanism relies on an exact-match denylist rather than comprehensive address checks (e.g., loopback), allowing an authenticated user to send requests to loopback services inside the container.

In Appsmith before version 2.1, the bundled Caddy reverse-proxy exposes an unauthenticated admin API on port 2019 inside the container. A low-privileged authenticated user can exploit an SSRF vulnerability to send a POST /load request to this API, fully replacing the live Caddy configuration and taking over the reverse proxy.

SiYuan is an open-source personal knowledge management system. Prior to version 3.7.0, Lute's HTML sanitizer does not remove <iframe> elements, allowing an attacker to include a malicious <iframe> in a Bazaar package README that executes arbitrary commands on the victim's machine.

A vulnerability in SiYuan before version 3.7.0 allows JavaScript injection via a crafted cell value in the attribute-view (database) renderer. An attacker with write access to a synced workspace can plant malicious content that executes arbitrary JavaScript when the victim opens the block-attribute panel. On Electron desktop with nodeIntegration enabled, this XSS can escalate to remote code execution (RCE) via require('child_process').

A vulnerability in SiYuan before version 3.7.0 allows JavaScript execution in the administrator's context by rendering a Bazaar package README. The flaw stems from an incomplete allowlist of event attributes in the lute sanitizer engine, which passes modern event handlers (e.g., onpointerover, onpointerdown) through.

SiYuan is an open-source personal knowledge management system. Prior to version 3.7.0, SiYuan Note's kernel HTTP server unconditionally trusts all chrome-extension:// origins, allowing RoleAdministrator access to every installed browser extension without authentication.

SiYuan is a knowledge management system that prior to version 3.7.0 had the /api/icon/getDynamicIcon endpoint which did not require authentication. Attackers can exploit this endpoint to execute arbitrary SELECT queries against the SiYuan SQLite database, leading to data leakage.

SiYuan is an open-source personal knowledge management system. Prior to version 3.7.0, a CSS snippet body containing </style> breaks out of its surrounding <style> tag, allowing arbitrary JavaScript execution in the renderer. On Electron desktop builds, the renderer runs with nodeIntegration:true, enabling access to require('child_process') from the injected handler, leading to remote code execution (RCE).

SiYuan is an open-source personal knowledge management system. In versions prior to 3.7.0, a vulnerability allowed an unauthenticated attacker to read arbitrary files in WorkspaceDir by double URL-encoding in the /assets/*path route.

Vulnerability in Chrome DevTools MCP (versions 0.24.0 to 1.1.0) allows bypassing workspace root restrictions via symbolic links. The path validation function does not canonicalize symbolic links, enabling read and write access to files outside the allowed area.

A vulnerability in chrome-devtools-mcp from version 0.20.0 to 1.1.0 allows a local low-privilege user to create a symbolic link to the daemon PID file, resulting in overwriting any victim's file with the daemon PID string.

Sentry is an error tracking and performance monitoring tool. From version 24.4.0 to 26.5.2, a Regular Expression Denial of Service (ReDoS) vulnerability exists in Sentry's event ingestion pipeline, where a regex applied to attacker-controlled fields on incoming events can be made to consume disproportionate CPU time.

SiYuan is an open-source personal knowledge management system. Prior to version 3.7.0, there is a stored cross-site scripting (XSS) vulnerability in the Attribute View asset cell renderer that can escalate to remote code execution (RCE) in the Electron desktop client.

Appsmith before version 2.1 exposes the supervisord XML-RPC interface on port 9001, reachable from outside the container via a Caddy reverse-proxy route at /supervisor/* on the public ingress. Combined with the APPSMITH_SUPERVISOR_PASSWORD exposed via GET /api/v1/admin/env, any authenticated administrator can send arbitrary XML-RPC calls to supervisord and execute OS commands inside the Docker container via twiddler.addProgramToGroup.

In Appsmith prior to version 1.99, the POST /api/v1/admin/send-test-email endpoint accepts attacker-controlled smtpHost and smtpPort values and establishes a raw JavaMail TCP connection without IP validation. This completely bypasses WebClientUtils.IP_CHECK_FILTER, which only applies to Spring WebClient HTTP requests. Additionally, the raw MailException.getMessage() is returned verbatim in the API error response, enabling error-based internal port scanning and service banner enumeration.