CVE Vulnerability Catalog

In OpenProject prior to versions 17.3.2 and 17.4.0, the meetings filter feature leaks whether a given user ID corresponds to a valid account and discloses the user's full name. This allows an attacker to enumerate all existing user accounts by probing user IDs and observing differences in server responses.

OpenProject before version 17.4.0 uses Sanitize::Config::RELAXED[:css] for inline style sanitization in Markdown rendering. This allows authenticated users with write access to inject arbitrary CSS properties in text fields (e.g., work package descriptions, comments).

Cudy LT300 running firmware prior to version 2.5.12 contains an OS command injection vulnerability. An authenticated attacker can inject shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface, leading to remote code execution.

Patool before version 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12. The vulnerability arises because the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check.

A vulnerability in Nx (versions 17.0.4 through 22.7.2 and 23.0.0-beta.2) occurs because the local HTTP server started by `nx graph` sets the `Access-Control-Allow-Origin: *` header on every response. This allows any website visited by a developer to read the server's responses cross-origin, including the full project graph and the output of the `/help` endpoint, which runs a target's configured help command.

In Envoy from version 1.37.0 to 1.37.5 and 1.38.3, the HTTP OAuth2 filter can leave an in-flight async token exchange attached to a downstream stream that has already been torn down. A late AsyncClient completion can invoke OAuth2Filter methods on a freed object, causing undefined behavior, worker crashes (availability loss), and use-after-free/invalid-vptr failures. This vulnerability is fixed in 1.37.5 and 1.38.3.

A vulnerability in Envoy allows a crash when using the %REQUESTED_SERVER_NAME(X:Y)% log format with HOST_FIRST or SNI_FIRST options and a missing host header. Affected versions are 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2.

In Envoy from version 1.36.0 to 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vulnerability exists in the ext_authz HTTP filter. It occurs when processing per-route authorization overrides concurrently with rapid downstream client disconnects, leading to a segmentation fault and process crash.

A vulnerability in Devolutions Remote Desktop Manager allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link. The issue affects the custom PowerShell VPN editor in versions 2026.2.5 through 2026.2.11.

The extract-zip library does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip extracts the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.

The mise tool (versions from 2026.3.15 to 2026.6.4) loads github.credential_command from a local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a repository can execute arbitrary shell commands when the victim runs a GitHub-related mise command and no higher-priority GitHub token environment variable is set.

Vulnerability in mise (versions prior to 2026.6.4) allows remote code execution without user interaction. The trust mechanism does not cover task-include files, enabling arbitrary command execution via tera templates with exec() function. Simply entering a directory with a repository and listing tasks (e.g., mise tasks) or using Tab completion triggers the exploit.

A vulnerability in mise (versions prior to 2026.6.1) allows creating a symlink outside the install directory by manipulating the version string in .tool-versions. The issue occurs in the HTTP backend, which uses the unsanitized version value to build the symlink path.

A vulnerability in DragonflyDB before version 1.39.0 allows remote server crash by sending a crafted RESTORE command. A specially crafted payload triggers an out-of-bounds read during listpack collection loading, causing a process crash (SIGSEGV).

Envoy before versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 mishandles HTTP/3 requests with a non-zero Content-Length header that are complete at the transport layer (HEADERS with FIN). This results in an upstream HTTP/1 request with unresolved body debt, enabling desynchronization and route bypass.

In Envoy from version 1.34.0 to 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in the TcpStatsdSink component where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16 KiB). An attacker can send an HTTP or gRPC request with an extremely long path (:path) recorded by the grpc_stats filter configured with stats_for_all_methods: true, causing a heap write overflow.

In Envoy, when the UDP DNS filter is configured with local or remote resolution for a name of 255 octets, a query with such a name causes abnormal process termination. This is due to an invalid runtime precondition that the name must be strictly less than 255 octets, contradicting RFC 1035.

In Envoy from version 1.23.0 to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, a vulnerability was found in the zstd decompressor implementation (ZstdDecompressorImpl). Processing a specially crafted, highly compressed zstd payload can lead to massive memory allocation. An attacker can exploit this to cause memory exhaustion, resulting in an OOM kill and Denial of Service (DoS) for the Envoy proxy.

In Envoy, an open-source edge and service proxy for cloud-native applications, the destructor of a JSON object causes a stack overflow when deeply nested objects (around 100k levels) are present. The vulnerability affects versions prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1.

A vulnerability in Envoy's TLS certificate validation allows an attacker to serve a certificate with a dNSName SAN containing an embedded NUL byte. Due to improper C-string casting, the domain name is truncated at the NUL, bypassing the exact match check and enabling unauthorized upstream routing.