CVE Vulnerability Catalog

The auth library (versions 1.18.0 to 1.25.2 and 2.0.0 to 2.1.2) incorrectly maps all authenticated Patreon users to the same local ID. This collapses identities, leading to unauthorized access and subscription data leakage.

Linkwarden prior to version 2.13.0 contains a Server-Side Request Forgery (SSRF) vulnerability in the fetchTitleAndHeaders function. Authenticated users can make arbitrary HTTP requests to internal services due to insufficient URL validation.

Termix prior to version 2.1.0 contains a command injection vulnerability in Docker container management endpoints, where the containerId parameter is directly interpolated into shell commands, allowing an authenticated attacker to achieve remote code execution on the managed server.

Sentry, an error tracking and performance monitoring tool, from version 21.12.0 to before 26.4.1 contains a critical vulnerability in the SAML SSO implementation. An attacker can take over any user account by using a malicious SAML Identity Provider and another organization on the same Sentry instance. The victim's email address must be known. The issue is patched in version 26.4.1.

FastGPT versions 4.14.10 through 4.14.13 contain an unauthenticated Remote Code Execution (RCE) vulnerability in the agent-sandbox component. The startup script entrypoint.sh initializes code-server with the --auth none flag and binds the service to all network interfaces (0.0.0.0:8080), allowing any user with network access to bypass authentication and gain full control over the sandbox environment.

Postiz, an AI social media scheduling tool, prior to commit da44801 contains a "Pwn Request" vulnerability in the Build and Publish PR Docker Image workflow. Any unauthenticated user can execute arbitrary code during the Docker build process and exfiltrate a highly privileged GITHUB_TOKEN (write-all permissions) by opening a Pull Request from a fork with a maliciously modified Dockerfile.dev.

Emlog is an open source website building system. Prior to version 2.6.11, direct SQL injection in article creation and update functions allowed attackers to execute arbitrary SQL commands.

Plunk is an open-source email platform that, prior to version 0.9.0, did not verify the SNS signature, certificate, or topic ARN for Amazon SNS notifications at the /webhooks/sns endpoint. This allows attackers to forge webhook requests.

n8n-MCP, an MCP server, has an authenticated server-side request forgery vulnerability affecting webhook trigger tools and the n8n API client. This issue exists in versions from 2.18.7 to before 2.50.2 and has been patched in version 2.50.2.

Data Space Portal is an open-source Software as a Service (SaaS) solution designed to streamline Dataspace management. From version 2.1.1 to before version 7.3.2, there is insufficient authorization in the dataspace-portal backend regarding self-registered 'PENDING' organization/user accounts.

In versions prior to 1.0.42-hotfix, the CLI flag --address and the NORNICDB_ADDRESS configuration were not correctly passed to the Bolt server configuration, resulting in the server always listening on all interfaces. This exposes the graph database to the local network with default admin:password credentials.

Directory Traversal vulnerability in fohrloop dash-uploader versions 0.1.0 through 0.7.0a2 allows a remote attacker to execute arbitrary code via the dash_uploader/httprequesthandler.py, BaseHttpRequestHandler.get_temp_root(), and BaseHttpRequestHandler._post() components.

The openvpn-auth-oauth2 plugin for OpenVPN server has a vulnerability that allows clients not supporting WebAuth/SSO to access the VPN despite being denied by the authentication logic. The issue exists in versions from 1.26.3 to before 1.27.3 when the plugin is deployed in experimental mode.

In ZEBRA, versions prior to 4.4.0 for zebrad and 6.0.0 for zebra-script had an issue with insufficient error handling during sighash computation, which could lead to the acceptance of an invalid hash type. This could create a consensus split between Zebra and zcashd nodes.

In the Linux kernel, a double free of the fcport structure was found in the qla2xxx SCSI driver. The function qla2x00_els_dcmd_sp_free() frees fcport, and a subsequent kref_put() call triggers a second free, potentially causing memory corruption.

In the Linux kernel, the ceph_handle_auth_reply() function in libceph contains an integer overflow vulnerability. The payload_len field from a CEPH_MSG_AUTH_REPLY message is stored as an int, so a value greater than INT_MAX becomes negative, leading to an out-of-bounds memory access. The fix changes the type to u32 and adds additional segment length sanity checks.

In the Linux kernel, libceph's process_message_header() could perform out-of-bounds reads if the message frame was maliciously corrupted so that the control segment length was smaller than the message header size, or a different frame was made to look like a message frame. An explicit bounds check was added before decoding the message header.

A use-after-free vulnerability was fixed in the Linux kernel's kthread mechanism. When a kthread exited via make_task_dead(), it bypassed kthread_exit() and missed affinity_node cleanup, causing memory to be freed while the node was still linked into the global kthread_affinity_list. A subsequent list_del() by another kthread wrote through dangling list pointers into the freed and reused memory, corrupting the pid's rcu.func pointer.

A vulnerability in the Linux kernel related to MAC comparison in the tcp-md5 protocol has been fixed to prevent timing attacks.

A vulnerability has been identified in the Linux kernel affecting the smb_lazy_parent_lease_break_close() function. The opinfo pointer is accessed after the RCU read unlock, leading to race conditions and potential use-after-free.