CVE Vulnerability Catalog

ZITADEL, an open source identity management platform, from 3.0.0 until 3.4.13 and 4.16.1 contains a vulnerability in Actions V1 that enables the goja Node-compatible require() registry without restricting its filesystem source loader. An organization Action author with ORG_OWNER, org.action.write, and org.flow.write permissions can run JavaScript at OIDC, SAML, and login-flow trigger points and load files readable by the ZITADEL server process. This can disclose mounted configuration and secrets, including credentials stored through ZITADEL_FIRSTINSTANCE_LOGINCLIENTPATPATH or ZITADEL_FIRSTINSTANCE_MACHINEKEYPATH, and recovered bootstrap credentials can enable escalation from an organization administrator to an instance administrator. This issue is fixed in versions 3.4.13 and 4.16.1.

ZITADEL, an open source identity management platform, from 4.0.0 until 4.16.1 contains a vulnerability in Login V2 that creates a browser session after password verification and can reuse that session for a later authentication request without verifying a user's enrolled TOTP, OTP, or U2F second factor. When the MFA step is abandoned and login starts again, session-validity checks require MFA only when the organization enables Force MFA or Force MFA for local users only, so a voluntarily enrolled factor can be skipped while completing an OIDC or SAML callback for a customer application. Login V1, the ZITADEL Console, Management and Admin APIs, and user self-management are not affected. This issue is fixed in version 4.16.1.

Wazuh, an open-source security platform providing unified XDR and SIEM protection, from 3.9.0 until 4.14.7 contains a vulnerability in wazuh-clusterd in framework/wazuh/core/cluster/common.py where a payload buffer is allocated using the size declared in a 20-byte cluster protocol header before Fernet decryption validates the peer. An unauthenticated network peer can declare a payload of up to 256 MiB, stop sending after the header, and retain that allocation until the TCP connection closes. The cluster listener has no application-level per-source connection budget, allowing concurrent sockets to multiply memory consumption and potentially terminate the cluster process, disrupt synchronization, and interrupt distributed API forwarding. This issue is fixed in version 4.14.7.

OpenObserve prior to version 0.90.3 exposes the /config/runtime endpoint without authentication, allowing an unauthenticated network client to read the full server configuration. The hide_sensitive_fields filter does not recognize dsn or creds field names, potentially exposing database credentials, administrator email, and other deployment details. This issue is fixed in version 0.90.3.

zbateson/mail-mime-parser versions 2.0.0 through 3.0.5 and 4.0.0 through 4.0.1 contain an uncontrolled resource consumption vulnerability (CWE-400). Three independent parsing paths have super-linear cost, so a crafted message under 2 MB can consume seconds of CPU or hundreds of megabytes to multiple gigabytes of memory, causing denial of service. The cost is incurred on the first getAllParts() or content read.

The zbateson/mail-mime-parser library prior to versions 3.0.6 and 4.0.2 is vulnerable to CRLF header injection (CWE-93) when building MIME messages with attacker-influenced attachment filenames. Filenames containing CR/LF can be serialized as additional header lines, such as a forged Bcc, enabling message exfiltration. Versions 1.x and 2.x are also affected but are end-of-life and will not receive patches.

DBHub prior to version 0.22.6 does not enforce read-only mode for the execute_sql tool even when readonly = true is set. The code that would enforce read-only is never executed, leaving only a simple classifier that checks the first keyword of each statement. This allows sequence tampering, arbitrary file writes, host file reads, and remote code execution. The HTTP transport is unauthenticated and binds to 0.0.0.0 by default.

Rsdoctor prior to version 1.5.16 starts a default HTTP report server that binds to all network interfaces (0.0.0.0) and exposes a POST /api/data/key endpoint without authentication and with wildcard CORS. This allows a remote attacker to retrieve full source code of compiled JavaScript modules, build configuration, and other sensitive data. The server is enabled by default in non-CI environments.

Python Social Auth prior to version 5.0.0 in the vk-app backend accepts VK callback data without verifying the signature when the auth_key parameter is omitted. An attacker can send unsigned attacker-controlled data and authenticate as an arbitrary VK user. The issue affects only applications using the vk-app backend. The fix in version 5.0.0 requires auth_key to be present and valid.

In the Linux kernel, a vulnerability in gfs2 was fixed: moved qc++ from the loop body into the for-loop increment expression in gfs2_quota_init(). This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot handling in the loop body.

In the chips-media wave5 driver, a use-after-free risk occurs when removing an instance from the list. The IRQ thread may acquire the spinlock between m2m_ctx release and removal, leading to a null pointer dereference.

In the Thunderbolt driver, there is a missing reference to XDomain during the service's lifetime. Since the service ID is released in tb_service_release() and the ID array is owned by the parent XDomain, a use-after-free risk exists. The fix keeps the reference.

In the Thunderbolt driver, after stopping the domain, the root_switch pointer is not set to NULL. The fix sets it to NULL, causing tb_xdp_handle_request() to return an error to the remote host. However, the uuid must be kept alive to respond until the domain is released.

In the Linux kernel, the drm/amdkfd driver's allocate_sdma_queue does not bounds-check the restore_sdma_id parameter, which could lead to invalid memory access.

In the Linux kernel, the get_wave_state() function in the drm/amdkfd driver trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read directly from the MQD. On the CRIU-restore path (AMDKFD_IOC_RESTORE_PROCESS) these values are attacker-controlled, leading to an unbounded copy_to_user() that can leak adjacent GTT/kernel memory (up to ~4 GiB via integer underflow or 1 MiB against a 4 KiB allocation).

A use-after-free vulnerability was found in the Linux kernel's virt: acrn module during eventfd shutdown. A race between acrn_irqfd_deassign() and the EPOLLHUP wakeup can free the same hsm_irqfd structure twice, allowing an attacker to exploit a dangling pointer. The issue was fixed by adopting the KVM irqfd lifetime model.

In the Linux kernel, the iwlwifi driver (MLD mode) has a vulnerability causing a kernel panic during failed reconfiguration after a NIC error. The issue stems from processing asynchronous notifications from dead firmware that reference freed memory (dangling pointer). The fix purges notifications immediately upon NIC error notification.

In the Linux kernel, the ACPICA component fixes a use-after-free in acpi_ds_terminate_control_method() by clearing references to method locals and arguments. The flaw could lead to use of freed memory.

In the Linux kernel, the ACPICA component adds boundary checks in acpi_ps_get_next_field() to prevent out-of-bounds access. The flaw could lead to reading or writing outside the allowed memory region.

In the Linux kernel, the ACPICA component prevents adding invalid references for local, argument, and debug objects in acpi_ut_copy_simple_object(). The flaw could lead to an invalid internal state of the ACPI interpreter.