CVE Vulnerability Catalog

Keystone, a content management system for Node.js, prior to version 6.5.3, contains a vulnerability in the findMany resolver that allows a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.

YOURLS, a self-hosted, customizable URL shortener written in PHP, from version 1.5.1 until 1.10.4 stores the HTTP Referer header and aggregates it in statistics, then passes it to the chart builder which concatenates labels into inline JavaScript without proper escaping. This allows an unauthenticated attacker to poison the statistics of an existing short URL with a crafted referrer, leading to execution of malicious JavaScript in the YOURLS origin when an administrator or public stats-page viewer opens the affected page. This issue is fixed in version 1.10.4.

Microsoft UFO, an open-source framework for intelligent automation, prior to version 3.0.8, contains an MCP server on localhost:8010 that does not validate Host, Origin, or Sec-Fetch-Site headers. An attacker-controlled web page can use DNS rebinding to reach the local /mcp endpoint, enumerate tool schemas, and invoke execute_command with a valid UFO_MCP_API_KEY, allowing reading files or executing allowed OS commands as the victim's user. This issue is fixed in version 3.0.8.

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.go to their creating user, and `GET /ws/terminal/:id` and `GET /ws/file/:id` only check whether the supplied UUID exists. An authenticated RoleMember who obtains a live stream UUID from logs, browser history, referer data, or telemetry can attach to another user's terminal or file-manager session, read and write target-server files, and execute shell commands. This issue is fixed in version 2.0.10.

Defuddle, an HTML page cleaner, prior to version 0.19.1, contains a vulnerability in site extractors that interpolate page-derived values (such as image alt and src, og:image, video descriptions) into HTML strings without context-appropriate escaping, and buildExtractorResponse() returns this contentHtml without DOM-based sanitization. A malicious page or attacker-controlled content can inject event-handler attributes or javascript URLs that execute when the extracted HTML is rendered. This issue is fixed in version 0.19.1.

Xinference is an inference API for running open-source, speech, and multimodal models. In 2.5.0 and earlier, Xinference passes attacker-influenced Llama3 tool-call output to eval() in xinference/model/llm/tool_parsers/llama3_tool_parser.py and xinference/model/llm/utils.py. Requests to /v1/chat/completions with a tools field flow through xinference/api/restful_api.py, xinference/model/llm/transformers/core.py, handle_chat_result_non_streaming(), and _post_process_completion() before extract_tool_calls() or _eval_llama3_chat_arguments() evaluates the model-generated Python expression. An unauthenticated remote attacker can influence that output through a crafted prompt and execute commands in the Xinference server process context. This issue is fixed in version 2.7.0.

Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep builds the join filter by inserting the raw separator and array token values into generated PHP without passing them through expression(). An attacker who can influence Volt template source can place quote-breaking content in a join argument, inject PHP into the compiled cache file, and execute it when Phalcon\Mvc\View\Engine\Volt::render() loads the template. This issue is fixed in version 5.16.0.

Miniflux 2 prior to 2.3.1 accepts redirect targets containing backslashes, which browsers normalize to forward slashes. An unauthenticated attacker can exploit this in the login flow to redirect a victim to an attacker-controlled external site, bypassing relative-path and host checks.

Runtipi in 4.10.0 and earlier accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during backup restore. An authenticated attacker can plant user-config/app.env as a symlink to an arbitrary reachable path and send PUT /api/user-config/demoapp3:_user with attacker-controlled appEnv content, allowing writes outside the intended restore and user-config directory boundary with Runtipi process permissions.

TensorZero, an open-source LLMOps platform, prior to version 2026.6.0, contains a vulnerability in the /internal/object_storage endpoint that accepts a caller-supplied storage_path parameter, dynamically overriding the [object_storage] configuration. Selecting the filesystem storage type allows arbitrary files on the gateway filesystem to be read, including credential files. Selecting the s3_compatible storage type causes outbound requests to attacker-chosen endpoints, including internal or cloud-metadata. Exploitation requires access to the gateway, which can be authenticated or unauthenticated depending on deployment. This issue is fixed in version 2026.6.0.

FiftyOne prior to 1.17.0 has a vulnerability where the App/API server and the /media route unconditionally return Access-Control-Allow-Origin: *. Because the embedded server is local and unauthenticated, a malicious website visited by the user can read cross-origin responses. The /media endpoint accepts a filesystem path, allowing a drive-by page to read files accessible to the server process and exfiltrate them without additional clicks.

KEDA prior to 2.20.0 has a vulnerability in constructing libpq-style connection strings from tenant-controlled values (host, port, userName, dbName, sslmode, password). escapePostgreConnectionParameter() only quotes values containing a literal space, so tabs, newlines, carriage returns, form feeds, vertical tabs, quotes, and backslashes can create additional key-value tokens when pgx parses the string. An attacker able to create or modify a TriggerAuthentication or ScaledObject can inject host or sslmode parameters, redirect the database connection to an attacker-controlled server, expose credentials, or disable intended TLS protection.

LibVNCClient, a library for easy implementation of a VNC client, in versions 0.9.12 through 0.9.15, contains a vulnerability that allows a malicious (or man-in-the-middle) VNC server to force a connecting libvncclient to write attacker-controlled data past the end of its framebuffer. This is an out-of-bounds heap write with attacker-controlled length, contents, and offset. It requires no authentication, works in a default build, and can crash the client or lead to code execution. The issue is patched in commit 540332be3e0acc566fa64da6f1b4680c72c724dd.

Picotls is a TLS protocol library that allows users to select different crypto backends. Prior to commit c14231d801407640bc42c2dcf92783409ea6a7c7, the ASN.1 validator recursively descends into constructed ASN.1 elements without enforcing a maximum nesting depth. If an application loads an attacker-supplied private-key file through ptls_minicrypto_load_private_key(), or otherwise calls the public ASN.1 validation API on untrusted DER, a crafted deeply nested ASN.1 structure can exhaust the process stack and crash the application.

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean() in internal/util/file.go. A malicious or compromised external module can place absolute or traversal paths in the manifest, causing cleanup to delete files outside the module cache that are accessible to the Terragrunt process before OpenTofu or Terraform executes.

Buildah is a tool that facilitates building OCI images. From 1.38.1 until 1.43.2 and 1.44.0, TempDirForURL in define/types.go does not securely confine Git repository subdirectories to the downloaded build context, and downloadToDirectory and stdinToDirectory can follow a Dockerfile symlink left by a partially extracted tar archive. A malicious server supplying a Git repository or tar archive can cause files outside the build context directory to be included in the context or copied into the build.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the universal search. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in pages/tagadmin.php. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the synchro import script. This issue has been fixed in version 3.2.3.

Combodo iTop, a web based IT service management tool, prior to version 3.2.3, contains a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3.