CVE Vulnerability Catalog

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update to the patched versions (5.8.21 and 4.16.17) to mitigate the issue. Craft 3 users should update to the latest Craft 4 and 5 releases, which include the fixes.

Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via a maliciously attached Behavior. The attack requires administrator access to the Craft Control Panel.

Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to authenticated Remote Code Execution via Twig SSTI. The vulnerability requires administrator access to the Control Panel with allowAdminChanges enabled, or a non-admin account with access to the System Messages utility. A malicious payload using the Twig `map` filter in Twig-accepting text fields can lead to RCE.

Craft CMS versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 have an SSRF vulnerability in the GraphQL `save_<VolumeName>_Asset` mutation. The `url` parameter in the `_file` input allows fetching content from arbitrary remote locations without validation, potentially leading to data exposure and infrastructure compromise.

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft installation could potentially expose sensitive assets via their user profile photo via maliciously crafted requests.

The jsPDF library prior to version 4.0.0 is vulnerable to local file inclusion and path traversal. An attacker can exploit the loadFile method, as well as addImage, html, and addFont, to read arbitrary files from the server's file system. The file contents are then embedded in generated PDF documents.

Dify, an open-source LLM app development platform, prior to version 1.11.0 exposes the API key in plaintext to the frontend, allowing non-administrator users to view and reuse it. This can lead to unauthorized access to third-party services and quota consumption. Version 1.11.0 fixes the issue.

W wersjach przed 6.1.1 biblioteka vega-functions, która implementuje funkcje dla języka wyrażeń Vega, pozwalała na wykorzystanie złośliwego kodu JavaScript (XSS) poprzez wewnętrzną funkcję, która nie jest częścią publicznego API. Problem został naprawiony w wersji 6.1.1.

A vulnerability in Vega library before versions 6.1.2 and 5.6.3 allows arbitrary JavaScript execution (DOM XSS) in applications that expose Vega and View objects globally and allow user-defined Vega specifications. The attack requires user interaction, such as opening a malicious specification.

Spinnaker, jako platforma do ciągłego dostarczania, jest podatny na atak typu server-side request forgery w wersjach przed 2025.1.6, 2025.2.3 i 2025.3.0. Atak ten umożliwia użytkownikom pobieranie danych z zdalnych adresów URL, które mogą być następnie wstrzykiwane do potoków Spinnakera.

A ReDoS vulnerability in Anthropic's MCP TypeScript SDK up to version 1.25.1 exists in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression contains nested quantifiers that can cause catastrophic backtracking on specially crafted inputs, leading to excessive CPU consumption.

Wykryto podatność bezpieczeństwa w projekcie Online Music Site w wersji 1.0. Problem dotyczy pliku /login.php, gdzie manipulacja argumentami username/password prowadzi do wstrzykiwania SQL.

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, an attacker can initiate a password reset for a victim and modify the Host header to a malicious value. The victim receives a password reset email with a link to the malicious host, and if clicked, the reset token is sent to the attacker's server, allowing account takeover.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a command injection vulnerability exists in the git source input fields of a resource, allowing a low privileged user (member) to execute system commands as root on the Coolify instance. As of time of publication, it is unclear if a patch is available.

Coolify is an open-source tool for managing servers, applications, and databases. In versions up to and including v4.0.0-beta.434, a low-privileged user (member) can view and use invitation links sent to an administrator. If they use the link before the legitimate recipient, they can log in as an administrator, resulting in privilege escalation.

Coolify (starting with version 4.0.0-beta.434) has a vulnerability that allows bypassing the rate limit on the /login endpoint by rotating the X-Forwarded-For header. This enables unlimited credential stuffing and brute-force attempts against user and admin accounts.

A DoS vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust application server resources via the "GET /images" API. The application fails to limit the height of the use-element shadow tree or the dimensions of pattern tiles during SVG processing, resulting in unbounded resource consumption and system-wide denial of service.

Coolify up to version v4.0.0-beta.434 contains a vulnerability that allows a low-privileged user (member) to invite a high-privileged user (administrator). Although the first invitation attempt fails with an error, clicking the invite button a second time succeeds. This enables an attacker to invite themselves as an administrator, then reset the password and log in with admin privileges.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434, low privileged users are able to see the private key of the root user on the Coolify instance. This allows them to ssh to the server and authenticate as root user, using the private key. As of time of publication, it is unclear if a patch is available.

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from docker-compose.yaml are not sanitized when used in commands. If a victim user creates an application from an attacker repository (using build pack "docker compose"), the attacker can execute commands on the Coolify instance as root. Version 4.0.0-beta.445 fixes the issue.