CVE Vulnerability Catalog

EmbedVideo Extension, a MediaWiki extension adding a #ev parser function and tags for embedding video clips from various services, prior to 4.1.0 with $wgEmbedVideoRequireConsent disabled (not the default) passes video URLs into an iframe src attribute without sanitization. When given a malformed URL or id, the src attribute can be escaped via double quotes, allowing HTML/JavaScript injection. Version 4.1.0 contains a patch.

Docmost, open-source collaborative wiki and documentation software, prior to 0.80.1 allows authenticated users to store attacker-controlled avatarUrl values that are later reused by avatar cleanup without confinement to the intended directory on local-storage deployments. A low-privileged user can cause deletion of arbitrary local files or directories reachable by the Docmost service account. This issue is fixed in version 0.80.1.

Honeywell PD45 Industrial Printer version F10.19.010040 contains an authenticated remote code execution via arbitrary file write in the Intermec Fingerprint Command Interface in the web management interface. An authenticated user with access to the admin or itadmin account can submit commands written in the Intermec Fingerprint programming language directly to the printer's internal command interpreter. Honeywell recommends updating to firmware F10.22.030745, which includes a fix.

The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into the agent's context. When a user runs the agent in a crafted repository as an untrusted workspace, sending any message can cause agent modifications to auto-loaded global configuration paths. Upgrading to Kiro IDE version 1.0.242 or later is recommended.

ZITADEL, an open source identity management platform, from 3.0.0 until 3.4.13 and 4.16.1 contains a vulnerability in Actions V1 that enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. This issue is fixed in versions 3.4.13 and 4.16.1.

ZITADEL, an open source identity management platform, from 4.0.0 until 4.16.1 contains a vulnerability in Login V2 that creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

Wazuh, an open-source security platform providing unified XDR and SIEM protection, from 3.9.0 until 4.14.7 contains a vulnerability in wazuh-clusterd in framework/wazuh/core/cluster/common.py where a payload buffer is allocated using the size declared in a 20-byte cluster protocol header before Fernet decryption validates the peer. An unauthenticated network peer can declare a payload of up to 256 MiB, stop sending after the header, and retain that allocation until the TCP connection closes. The cluster listener has no application-level per-source connection budget, allowing concurrent sockets to multiply memory consumption and potentially terminate the cluster process, disrupt synchronization, and interrupt distributed API forwarding. This issue is fixed in version 4.14.7.

OpenObserve prior to version 0.90.3 exposes the /config/runtime endpoint without authentication, allowing an unauthenticated network client to read the full server configuration. The hide_sensitive_fields filter does not recognize dsn or creds field names, potentially exposing database credentials, administrator email, and other deployment details. This issue is fixed in version 0.90.3.

zbateson/mail-mime-parser versions 2.0.0 through 3.0.5 and 4.0.0 through 4.0.1 contain an uncontrolled resource consumption vulnerability (CWE-400). Three independent parsing paths have super-linear cost, so a crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory, causing denial of service. The cost is incurred on the first getAllParts() or content read.

The zbateson/mail-mime-parser library prior to versions 3.0.6 and 4.0.2 is vulnerable to CRLF header injection (CWE-93) when building MIME messages with attacker-influenced attachment filenames. Filenames containing CR/LF can be serialized as additional header lines, such as a forged Bcc, enabling message exfiltration. Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches.

DBHub prior to version 0.22.6 does not enforce read-only mode for the execute_sql tool even when readonly = true is set. The code that would enforce read-only is never executed, leaving only a simple classifier that checks the first keyword of each statement. This allows sequence tampering, arbitrary file writes, host file reads, and remote code execution. The HTTP transport is unauthenticated and binds to 0.0.0.0 by default.

Rsdoctor prior to version 1.5.16 starts a default HTTP report server that binds to all network interfaces (0.0.0.0) and exposes a POST /api/data/key endpoint without authentication and with wildcard CORS. This allows a remote attacker to retrieve full source code of compiled JavaScript modules, build configuration, and other sensitive data. The server is enabled by default in non-CI environments.

Python Social Auth prior to version 5.0.0 in the vk-app backend accepts VK callback data without verifying the signature when the auth_key parameter is omitted. An attacker can send unsigned attacker-controlled data and authenticate as an arbitrary VK user. The issue affects only applications using the vk-app backend. The fix in version 5.0.0 requires auth_key to be present and valid.

In the Linux kernel, a vulnerability in gfs2 was fixed: moved qc++ from the loop body into the for-loop increment expression in gfs2_quota_init(). This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot handling in the loop body.

In the chips-media wave5 driver, a use-after-free risk occurs when removing an instance from the list. The IRQ thread may acquire the spinlock between m2m_ctx release and removal, leading to a null pointer dereference.

In the Thunderbolt driver, there is a missing reference to XDomain during the service's lifetime. Since the service ID is released in tb_service_release() and the ID array is owned by the parent XDomain, a use-after-free risk exists. The fix keeps the reference.

In the Thunderbolt driver, after stopping the domain, the root_switch pointer is not set to NULL. The fix sets it to NULL, causing tb_xdp_handle_request() to return an error to the remote host. However, the uuid must be kept alive to respond until the domain is released.

In the Linux kernel, the drm/amdkfd driver's allocate_sdma_queue does not bounds-check the restore_sdma_id parameter, which could lead to invalid memory access.

In the Linux kernel, the get_wave_state() function in the drm/amdkfd driver trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read directly from the MQD. On the CRIU-restore path (AMDKFD_IOC_RESTORE_PROCESS) these values are attacker-controlled, leading to an unbounded copy_to_user() that can leak adjacent GTT/kernel memory (up to ~4 GiB via integer underflow or 1 MiB against a 4 KiB allocation).

A use-after-free vulnerability was found in the Linux kernel's virt: acrn module during eventfd shutdown. A race between acrn_irqfd_deassign() and the EPOLLHUP wakeup can free the same hsm_irqfd structure twice, allowing an attacker to exploit a dangling pointer. The issue was fixed by adopting the KVM irqfd lifetime model.