CVE Vulnerability Catalog

Vulnerability in the cal.com repository (later cal.diy) in GitHub Actions. The pr.yml workflow uses the pull_request_target trigger with default write permissions, allowing an attacker to execute arbitrary commands with the write-scoped GITHUB_TOKEN. An attacker can push commits, merge or mutate pull requests, add or delete comments, and delete or force-push branches.

A vulnerability in beetl library version 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism.

Vulnerability in nebula-mesh allows privilege escalation due to missing access controls on many API endpoints. Any operator with an API key can access resources of other operators.

The SAML Single Sign On – SSO Login plugin for WordPress up to version 5.4.4 is vulnerable to authentication bypass. The mo_saml_validate_signature() function performs a loose boolean check on openssl_verify() output, treating error -1 as truthy. An unauthenticated attacker can log in as any WordPress user, including administrators, by sending a crafted SAMLResponse with a deliberately malformed signature.

A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body).

The Appriss Insights (Equifax) Victim Information Notification Exchange (VINE) applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over accounts, access sensitive PII, and dump other information from the database.

DbGate versions 7.1.8 and prior are vulnerable to authenticated Remote Code Execution (RCE). Any user with valid DbGate credentials can execute arbitrary OS commands as root by exploiting an unsanitized functionName parameter in the /runners/load-reader endpoint. The require = null mitigation is trivially bypassed via dynamic import(). Version 7.1.9 contains a patch.

In DbGate, the unzipDirectory() function does not validate extracted file paths, allowing path traversal. In default Docker deployment, a network attacker can exploit this to execute arbitrary code as root.

Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by unauthenticated remote code execution due to a vulnerable agent API.

SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows unauthenticated remote attackers to read and exfiltrate arbitrary files by supplying attacker-controlled filesystem paths through the audio_path field of an unauthenticated POST request to the /wav2wav route. Attackers can pass arbitrary server-side paths verbatim to librosa.load, torchaudio.load, and soundfile.write sinks, causing the server to decode and return file contents via the HTTP response body while also writing attacker-specified .wav files to arbitrary locations on the filesystem.

h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process. The get_user_dir function uses the bearer token unsanitized as a path component, and the default API key is empty, bypassing authentication. Attackers can achieve remote code execution by writing to startup files.

Tugtainer before version 1.30.2 is vulnerable to Server-Side Template Injection (SSTI) in the notification template feature. The `title_template` and `body_template` fields are rendered using an unsandboxed `jinja2.Environment`, allowing any authenticated user to execute arbitrary OS commands as root inside the container.

DbGate, a cross-platform database manager, in versions 7.1.8 and prior contains a remote code execution vulnerability in the JSON script runner (POST /runners/start). Code injection occurs via the functionName parameter in JSON script assign commands, which is interpolated directly into dynamically generated JavaScript code. The code is executed in a forked Node.js child process. Version 7.1.9 contains a patch.

In Kata Containers prior to version 3.31.0, the default configuration allows pod creators to inject arbitrary command-line arguments into the virtiofsd process through the `io.katacontainers.config.hypervisor.virtio_fs_extra_args` pod annotation. By injecting `-o source=/` along with `--no-announce-submounts` and `--sandbox=none`, an attacker can override the virtiofsd shared directory to serve the entire host root filesystem into the guest VM. Combined with the `kernel_params` annotation (also enabled by default) to activate the agent debug console, the attacker can mount the host filesystem from inside the VM and read or write any file on the host, including /etc/shadow.

The Easy Store extension for Joomla versions 1.0.0-2.0.1 contains an unauthenticated SQL injection via improper validation of order parameters, allowing full database read access including credentials and sessions.

Improper access checks in the Easy Store extension (versions 1.0.0-2.0.1) for Joomla allow logged-in users to retrieve order and customer information of any order in the system.

Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities.

Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access.

Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding.

Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account.