CVE Vulnerability Catalog

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management (RHACM). A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the `secretRef.Namespace` field. This allows the `GetSecret()` function in the HelmRelease controller to fetch sensitive credentials from any namespace, which are then sent to an attacker-controlled Helm repository.

Dockge validates a stack name only on the write path, allowing an authenticated user to use traversal sequences in the name to access directories outside the managed stacks directory. This can disclose .env or Compose files and delete directories containing a valid Compose file. With disableAuth enabled, these operations are available without authentication.

Centrifugo before version 6.9.0 allows a remote client to spoof headers such as x-trusted-user in connect, refresh, subscribe, publish, RPC, and related proxy calls when the backend relies on that header for authentication or authorization. The vulnerability arises from copying client-controlled headers into the connection context and forwarding them as trusted backend headers.

In libvips before version 8.18.3, applications using custom sources and processing untrusted PPM images can trigger a max/min error in vips_source_read_to_memory. Using VIPS_MAX instead of VIPS_MIN when selecting the read size can cause up to 4032 bytes to be written beyond the allocated buffer, leading to memory corruption or process crash.

In libvips before version 8.18.3, the old-style Radiance RLE decoder can process a repeat marker at the beginning of a scanline and read q[-1] before any prior pixel exists. This can disclose four bytes of adjacent heap data when loading a crafted Radiance image.

libvips before 8.18.3, built with libultrahdr support, can incorrectly size an output buffer in uhdrsave.c when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map. This can cause a heap buffer over-read.

In libvips before version 8.18.3, built without libtiff support but with ImageMagick support, the combined frame height can overflow while loading a crafted multi-page TIFF. Calculations multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash.

libvips before version 8.18.3 has a vulnerability that allows a crafted many-band TIFF to evade scanline validation and cause an integer overflow, leading to out-of-bounds reads/writes, possible data disclosure, and likely crashes. Remote code execution has not been demonstrated but cannot be ruled out.

In DiceBear before version 9.4.3, the rotate, fontSize, and fontWeight options are interpolated into SVG attributes without proper XML escaping. This allows injection of arbitrary SVG markup, which can lead to script execution in the page origin if the generated avatar is embedded inline or opened as an image.

A vulnerability in the multicloud-operators-subscription component allows a tenant with permissions to create HelmRelease custom resources to bypass security controls. The HelmRelease controller processes chart templates with elevated ServiceAccount privileges without proper validation, enabling deployment of arbitrary resources across the cluster.

In Mailpit before version 1.30.4, the GET /api/v1/message/{id}/part/{partID}/thumb endpoint decodes image attachments into a full raster before checking dimensions, pixel count, or memory use. A compact image with very large dimensions can consume disproportionately large memory and CPU, potentially leading to service availability degradation.

In Mailpit before version 1.30.4, the SMTP command reader allocates the full command line before enforcing the 512-octet limit. An unauthenticated remote SMTP client can send an oversized single command line, which can lead to excessive memory consumption and reduced service availability.

OTRS Community Edition has an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary commands by supplying crafted values for the PGP binary path and command options. The values are concatenated without sanitization into a shell command, enabling command execution as the web server user.

A vulnerability in the 100xdevs CMS version 1.0 allows a remote attacker to obtain sensitive information via the src/middleware.ts and src/app/api/mobile/search/route.ts components.

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.

NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values. This could allow unauthorized actions on the system.

The Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards has an improper input validation vulnerability that allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This is a form of prototype pollution leading to remote code execution.

In lin-snow Ech0 up to 5.4.1, a vulnerability exists in the MD5Encrypt function in internal/util/crypto/crypto.go. The use of a risky cryptographic algorithm can be exploited remotely, though the attack complexity is rather high.

In the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1, there is incorrect privilege assignment. An authenticated remote user can read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint.

In the github-issue-bot templates in appwrite/templates, the GitHub webhook signature verification is inverted. When the X-Hub-Signature-256 header is absent, the verifyWebhook function returns success without HMAC verification, allowing unauthenticated requests to pass and post a comment on a chosen repository and issue using the configured GITHUB_TOKEN.