CVE Vulnerability Catalog

libvips before 8.18.3, built with libultrahdr support, can incorrectly size an output buffer in uhdrsave.c when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map. This can cause a heap buffer over-read.

In libvips before version 8.18.3, built without libtiff support but with ImageMagick support, the combined frame height can overflow while loading a crafted multi-page TIFF. Calculations multiply the per-page Ysize by n_frames without a checked bound, which can cause a heap buffer over-read and process crash.

libvips before version 8.18.3 has a vulnerability that allows a crafted many-band TIFF to evade scanline validation and cause an integer overflow, leading to out-of-bounds reads/writes, possible data disclosure, and likely crashes. Remote code execution has not been demonstrated but cannot be ruled out.

In DiceBear before version 9.4.3, the rotate, fontSize, and fontWeight options are interpolated into SVG attributes without proper XML escaping. This allows injection of arbitrary SVG markup, which can lead to script execution in the page origin if the generated avatar is embedded inline or opened as an image.

A vulnerability in the multicloud-operators-subscription component allows a tenant with permissions to create HelmRelease custom resources to bypass security controls. The HelmRelease controller processes chart templates with elevated ServiceAccount privileges without proper validation, enabling deployment of arbitrary resources across the cluster.

In Mailpit before version 1.30.4, the GET /api/v1/message/{id}/part/{partID}/thumb endpoint decodes image attachments into a full raster before checking dimensions, pixel count, or memory use. A compact image with very large dimensions can consume disproportionately large memory and CPU, potentially leading to service availability degradation.

In Mailpit before version 1.30.4, the SMTP command reader allocates the full command line before enforcing the 512-octet limit. An unauthenticated remote SMTP client can send an oversized single command line, which can lead to excessive memory consumption and reduced service availability.

OTRS Community Edition has an authenticated OS command injection vulnerability in the PGP encryption module that allows administrators to execute arbitrary commands by supplying crafted values for the PGP binary path and command options. The values are concatenated without sanitization into a shell command, enabling command execution as the web server user.

A vulnerability in the 100xdevs CMS version 1.0 allows a remote attacker to obtain sensitive information via the src/middleware.ts and src/app/api/mobile/search/route.ts components.

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1.

NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values. This could allow unauthorized actions on the system.

The Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards has an improper input validation vulnerability that allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This is a form of prototype pollution leading to remote code execution.

In lin-snow Ech0 up to 5.4.1, a vulnerability exists in the MD5Encrypt function in internal/util/crypto/crypto.go. The use of a risky cryptographic algorithm can be exploited remotely, though the attack complexity is rather high.

In the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1, there is incorrect privilege assignment. An authenticated remote user can read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint.

In the github-issue-bot templates in appwrite/templates, the GitHub webhook signature verification is inverted. When the X-Hub-Signature-256 header is absent, the verifyWebhook function returns success without HMAC verification, allowing unauthenticated requests to pass and post a comment on a chosen repository and issue using the configured GITHUB_TOKEN.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

An unauthenticated attacker with network access to the captive portal service can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

A vulnerability in Comfast CF-N1-S version 2.6.0.1 affects the function sub_44B50C in the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. Manipulation results in a stack-based buffer overflow, and the attack can be launched remotely. The exploit has been made public and could be used.

django CMS from 5.0.8 until 5.0.9 has a vulnerability where ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering.