CVE Vulnerability Catalog

In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back to matching the username when the provider ID does not belong to any known user, and does not reject a conflicting non-empty provider ID. If an identity provider reassigns an email address, which authd uses as the username, to a new account, the new account inherits the previous user's local UID and home directory on its next login.

Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned requests while resolvePathCacheKey() produces cache keys from the request path, site URL, and normalized rendering options exposed through image URLs and server responses. An unauthenticated attacker can provide attacker-controlled image data through the title parameter together with a derived cacheKey and populate the cache slot used for a legitimate Open Graph image, causing spoofed image content to be served to users.

OpenNext Cloudflare, a Next.js adapter for Cloudflare, in versions from 0.3.0 until 1.20.2 mishandles encoded pathnames when cache interception is enabled and access control relies on middleware. An unauthenticated attacker can retrieve cached protected content using a percent-encoded pathname that does not match authorization middleware but decodes to the cache key of a protected route.

kin-openapi, a Go project for handling OpenAPI files, prior to 0.149.0 lacks cycle detection when an allOf, anyOf, or oneOf chain refers back to an ancestor schema during runtime request and response validation. This causes unbounded recursion and a fatal stack overflow that terminates the entire process and cannot be caught with recover.

kin-openapi, a Go project for handling OpenAPI files, in versions from 0.136.0 until 0.149.0 lacks a nil-items guard for legal OpenAPI 3.1 array schemas in three openapi3filter decoder paths. An unauthenticated remote client can trigger a deterministic nil-pointer panic via an array query parameter, a deepObject query parameter, or an application/x-www-form-urlencoded request body.

Sonatype Nexus Repository 3 allows a user holding the role create or role update permission to grant roles and privileges that the account does not hold. This can lead to privilege escalation up to full administrative access.

Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploaded R package. The script runs in the browser of a user who opens the details of that package in the Browse user interface, with the permissions of the viewing user.

Sonatype Nexus Repository 3 allows an unauthenticated remote attacker to supply attacker-controlled input to a Java class loading call through an ExtDirect endpoint. This allows the attacker to learn whether specific classes are present in the application. The issue does not by itself allow code execution.

Nexus Repository 3 lacks an authorization check in the NuGet Components API upload path, allowing an account with only repository read and browse privileges to upload NuGet symbol packages (.snupkg). Exploitation requires a hosted NuGet repository with Symbol Server enabled, and with anonymous access enabled this precondition is met by default.

kin-openapi, a Go project for handling OpenAPI files, in versions from 0.136.0 until 0.143.0 accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding requests and responses. A remote unauthenticated client can deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse.

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.

Ansible Operator Plugins contains a Jinja2 template injection vulnerability. A low-privileged Kubernetes user can craft malicious custom resource (CR) specification values that are processed by Ansible without proper sanitization, leading to code execution in the operator pod.

A Regular-Expression Denial of Service (ReDoS) in the Markdown2 extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor duplicates the attachment without checking whether the caller can read it, bypassing record-level and field-level restrictions and exposing the file contents through the copied attachment. Obtaining a valid attachment identifier may be difficult. This issue is fixed in version 10.0.2.

OPNsense, a FreeBSD-based firewall and routing platform, prior to 26.1.11 mishandles privilege values in ACL::hasPrivilege(). A user directly assigned both a component write privilege and user-config-readonly can be treated as lacking the read-only restriction, allowing MVC APIs to persist configuration changes.

OPNsense, a FreeBSD-based firewall and routing platform, prior to 26.1.11 allows carriage-return and line-feed characters in the WebGUI login username field. An attacker with network access to the login page can forge authentication events for another IP, adding it to the sshlockout PF table, or reset their own brute-force counter.

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11.

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11.

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.