CVE Vulnerability Catalog

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders that continue using the inconsistent Store.

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting the host stack.

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread movement of !Send host variables.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created StreamReader<U> that the embedder reads as StreamReader<T>, where both types map to the same component model type, crashing the embedding process.

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate sub-components to exceed the per-instance cap many times over, causing unbounded host memory growth.

Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and destination alias each other, crashing the host instead of raising a trap.

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 65535, overflowing a u16 index in the http crate and triggering a host panic.

Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API clients to bypass the egress proxy by enabling check_cache_freshness. Attackers can cache a controlled URL, then trigger CacheValidator to follow 302 redirects or DNS rebinding to internal and cloud-metadata addresses for port and service discovery.

Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows authenticated API clients to run arbitrary JavaScript in the crawl page via allowlisted css_selector and wait_for fields. Attackers can inject quotes into css_selector or supply js: conditions in wait_for, bypassing the js_code block to alter page state and returned crawl content.

Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability because Chromium always launches with --ignore-certificate-errors. Man-in-the-middle or DNS-controlling attackers can serve forged content to the crawler and read cookies and headers sent, while hard-coded --no-sandbox also overrides CRAWL4AI_CHROMIUM_SANDBOX.

KeePassXC from 2.3.0 until 2.8.0 has a browser integration flaw: authorized response encryption in BrowserMessageBuilder.cpp uses a fixed 1 MiB output vector even though crypto_box_easy() writes plaintext length plus crypto_box_MACBYTES. A browser-protocol client with IPC access and a valid database association can trigger a sequential out-of-bounds write before any response is delivered. Fixed in 2.8.0.

The Hotel Booking plugin in versions up to 3.8 contains an Insecure Direct Object References (IDOR) vulnerability in the subscriber area. This allows unauthorized access to resources identified by object references.

The Plus Addons for Elementor Page Builder Lite in versions up to 6.5.3 contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This allows an attacker to store a malicious script that executes in a user's browser.

P-Net before 1.0.3 does not check that a complete block header is present in received data before reading the next block in DCP Set and Identify requests. If the last block ends at the end of the receive buffer, the next block's length is read past the buffer. Additionally, a DCP Set block shorter than the two-byte block qualifier causes a length underflow, processing the block as 65534 bytes. This can cause a crash (denial of service) or disclose a small amount of memory. Requires adjacent network access.

Adobe Digital Editions is affected by a Path Traversal vulnerability due to improper limitation of a pathname to a restricted directory. An attacker could leverage this to bypass security measures and gain unauthorized write access. Exploitation requires user interaction in that a victim must open a malicious file, and the scope is changed.

IBM Langflow OSS versions 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage of sensitive information. The flaw involves improper protection of such data.

IBM Langflow OSS versions 1.0.0 through 1.12.8 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently protected credentials. The flaw involves weak protection of authentication data.

IBM Langflow OSS versions 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.

The Happy Addons for Elementor plugin in versions up to 3.50.1 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of misconfigured security mechanisms.

Mission Control / AIMSICD versionCode 2026080501 has insecure permissions that allow unauthorized attackers to invoke an exported component, impacting the tracker blocker mechanism of the application.