CVE Vulnerability Catalog

Apache CloudStack versions 4.7.0 through 4.20.3.0 and 4.21.0.0 through 4.22.1.0 have a missing release of resource after effective lifetime vulnerability in the scoped global configuration functionality. This may lead to denial of service (DoS) for the management server.

Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header. The header is read directly at several points, and nothing binds the value to the caller. A client can name another user's identifier and read or write that user's stored LLM memory. The fix introduces a single resolve_memory_identity seam that honors the header only for loopback or allowlisted callers and otherwise binds the identity to the proxy-token fingerprint or the operating system user. The pip console script binds 127.0.0.1 by default, but the reference docker-compose.yml ships --host 0.0.0.0 with published ports and no required HEADROOM_PROXY_TOKEN, exposing the affected data-plane routes to the network without authentication.

Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header. No check rejects loopback, link-local, or RFC 1918 destinations, so requests reach internal services and cloud metadata addresses. The Authorization header is forwarded unchanged to the caller-designated host. The reference docker-compose.yml exposes ports without required token, increasing risk.

Roskus Prospero Flow CRM versions 5.0.0 through 5.3.5 have an authorization bypass through user-controlled key in the transaction API. An authenticated user can read transactions of other companies on the same instance via an incremented identifier in GET /api/transaction/{id}, without company scoping or permission check.

The Joomla extension Zoo (from yootheme.com) before version 4.1.66 has missing CSRF tokens on front-end state changes, enabling CSRF attacks.

Spring AI versions 2.0.0, 1.1.0-1.1.8, and 1.0.0-1.0.9 have a vulnerability in tool calling support where the per-request tool list is not fully enforced. Under certain conditions, a tool not made available to the current request could be invoked, potentially leading to privilege escalation.

In Spring AI's Semantic Cache support, the context hash used to isolate cached responses between different system prompts could allow cached responses to be shared across unrelated contexts. Affected versions: Spring AI 2.0.0.

The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not limit the number of sessions it retains and by default does not require client authentication. A remote attacker can cause unbounded session accumulation, gradually exhausting memory and leading to Denial of Service (DoS) for all legitimate clients. Affects Spring AI version 2.0.0.

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login and registration date.

The Limit Login Attempts Reloaded WordPress plugin before version 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

The Passster WordPress plugin before 4.3.9 does not correctly match its own public endpoint paths when deciding which REST API requests may bypass global password protection, comparing them as an unanchored substring of the request URI rather than against the resolved route, allowing an unauthenticated attacker to read the content of globally password-protected posts and pages.

The Charitable WordPress plugin before 1.8.12 does not verify the authenticity of incoming Square payment webhook events in a default configuration, allowing unauthenticated attackers to forge webhook notifications that mark donations as paid without any real payment.

The myCred WordPress plugin before 3.2.5 does not verify that the receiver of an incoming payment gateway notification matches the site's configured merchant account, allowing unauthenticated attackers to have arbitrary amounts of the site's in-site currency credited to an account by completing a payment for the expected amount to a gateway account they control rather than the site's.

The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF).

The Eventin WordPress plugin before version 4.1.21 does not validate a user-supplied webhook URL stored on events nor verify event ownership, allowing users with contributor-level access and above to trigger blind server-side requests to arbitrary hosts.

The report.list procedure in Reconmap's trpc package accepted a projectId and a dashboardId, but only verified membership for the supplied projectId, not that the dashboardId belonged to that project. An authenticated user could pair a projectId from their own organization with a dashboardId from another organization and receive every report in that dashboard. A correctly scoped helper, listReportsCore, already existed but was not used by the router.

The report.get procedure in the TRPC router accepts only a reportId and returns getReportById(reportId) without access checks. The enforceAccess middleware only evaluates membership when the input carries a projectId or organizationId key, so a reportId alone passes through unchecked. An authenticated user can read the full configuration of any saved report, including projectId, event series, filters, breakdowns, and formulas.

Reconmap's API applies a fallback authorization policy requiring an authenticated administrator, but the report preview action in ReportsController.cs carries [AllowAnonymous], opting out of that policy. PreviewReport loads the project and linked organisation without any authentication, membership, or role check. Because the id is an auto-increment primary key, an unauthenticated attacker can walk sequential ids to retrieve sensitive details of all projects.

The filestore backend in pkg/object/file.go, used for file:// stores and as a common juicefs sync destination, derives every operation's target from path(key) without checking that the result stays within the root. Object keys from an external store can contain traversal segments, allowing writes outside the intended local directory with no error. An operator syncing from a not fully controlled bucket is exposed to file writes at attacker-influenced locations.

A vulnerability in the misp-stix library stems from incomplete clearing of parser state between STIX document conversions. Reusing the same parser instance can cause data from a previously processed document (e.g., galaxies, DNS records, titles, timestamps) to be incorporated into the MISP event generated from a subsequent document. The issue affects both STIX 1 and STIX 2 parsers.