CVE Vulnerability Catalog

Perses versions 0.43.0 through 0.54.0-rc.0 authorize datasource creation and unsaved datasource proxy paths on a Datasource or GlobalDatasource scope without requiring read permission for the separately grantable associated project or global Secret. A low-privilege user can attach a Secret they cannot read, point the datasource at a user-controlled service, and cause Perses to send the decrypted secret in plaintext, bypassing scope separation.

LubeLogger prior to 1.6.8 allows an authenticated user to submit caller-controlled recordIds to the DuplicateRecordsToOtherVehicles endpoint while naming destination vehicleIds the user can edit. The endpoint authorizes destination vehicles but fetches source records without checking UserCanEditVehicle for each existingRecord.VehicleId, allowing records belonging to another user to be copied into an attacker-controlled vehicle.

LubeLogger prior to 1.6.8 allows authenticated non-administrative users to reach HandleTranslationFileUpload and influence the name passed to RenameFile, which constructs newFilePath without verifying the resolved absolute path remains under the web root or data directory. A crafted upload name can move an uploaded file outside the intended storage directory.

Icinga 2 from 2.4 until 2.14.9, 2.15.4, and 2.16.2 writes attacker-controlled template names into generated configuration without escaping them. An authenticated ApiUser with an objects/create/* permission can inject Icinga 2 DSL configuration, create additional objects, and exceed the user's assigned privileges.

Icinga 2 prior to 2.14.9, 2.15.4, and 2.16.2 does not bound JSON nesting depth, allowing deeply nested JSON to exhaust the call stack. The affected JSON parsing paths are reachable by unauthenticated network clients through the Icinga 2 service on TCP port 5665, allowing a remote attacker to crash the process.

LMDeploy versions 0.12.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620. An attacker can execute arbitrary Python code by publishing a malicious HuggingFace model with a crafted quantization_config.quant_dtype value, which is passed to eval() without validation.

Parseable prior to 3.0.0 uses unwrap() while parsing the x-amz-firehose-common-attributes header before authentication. A remote unauthenticated attacker can supply non-UTF-8 header data, malformed JSON, or invalid derived header values that trigger a Rust panic and interrupt request handling.

A vulnerability in Mongoid (object-document mapper) involves an insecure direct object reference in nested attributes handling. A user with basic privileges can reference a record identifier that is not their own, causing the record to be looked up without usual ownership restrictions, then updated and linked to the attacker's record.

A vulnerability in Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha to 0.3.2) involves missing authentication in the file backend/app/dependencies.py of the FastAPI component. Remote attack is possible, allowing access to functions without authentication.

A vulnerability in Cockpit allows an unauthenticated remote attacker to initiate and sustain numerous simultaneous connections to the cockpit-tls service, forcing it to create an unbounded number of threads and consume system resources such as memory and file descriptors. The result is a denial of service (DoS).

A vulnerability in Convoy (webhooks gateway) prior to 26.6.8 affects the GET /api/v1/projects/{projectID}/sources/{sourceID} endpoint. The endpoint authorizes access to the project in the URL, but Handler.GetSource fetches the Source only by sourceID without confirming that its ProjectID matches the authorized project. An authenticated user or project-scoped API key holder can substitute another tenant's Source identifier and receive that Source's complete record, including unredacted AMQP, Kafka, SQS, or Google PubSub credentials.

A vulnerability in the adm-zip library (JavaScript) prior to 0.6.1 affects getData() in zipEntry.js, which trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data. A small crafted ZIP can declare a multi-gigabyte uncompressed size, causing excessive memory consumption before CRC validation reports an error. Applications reading entries from untrusted archives can be terminated by the OS or suffer memory exhaustion.

A vulnerability in WACRM (self-hostable CRM template for WhatsApp) in version 0.7.0 and earlier affects flow and automation write routes that authenticate account viewers but do not enforce the agent role before using a service-role database client that bypasses row-level security. A viewer can create, edit, activate, or delete flows and create active automations and trigger outbound WhatsApp actions without the required role.

In NanoMQ MQTT broker prior to 0.24.14, the nmq_subinfo_decode() function reuses the length variable from the outer Properties Length while parsing each subscription identifier. A remote client can send a SUBSCRIBE packet with a multi-byte Properties Length and repeated subscription identifiers, causing a read beyond the heap message buffer. The issue is fixed in version 0.24.14.

In AnyIO 4.14.0, open_process() forwards the group argument to the backend instead of extra_groups, despite accepting the extra_groups parameter. A call with extra_groups=[] to clear inherited supplementary groups can launch a child process that retains the parent's groups, weakening a privilege-dropping boundary. This affects POSIX applications using AnyIO subprocess helpers and is fixed in version 4.14.2.

In btrbk from 0.29.0 until 0.32.7, the ssh_filter_btrbk.sh script constructs allow_stream_match with a start anchor but no end-of-string anchor for the full command. A user restricted via an authorized_keys forced command can append a trailing pipe command after a valid btrbk prefix, bypassing the allowlist and executing arbitrary commands with the backup-target SSH account's privileges. This is fixed in version 0.32.7.

In zot registry prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the distinct delete permission. Bearer-authenticated requests also bypass the DistSpecAuthzHandler path, and DeleteManifest and DeleteBlob perform no independent delete-permission check. A remote attacker with a token limited to pull and push can delete manifests and blobs within the token's repository scope. This is fixed in version 2.1.18.

In Capsule prior to 0.13.7, ForbiddenListSpec.ExactMatch in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively and then uses sort.SearchStrings, which assumes byte-order sorting. When the forbidden list mixes capitalized and lowercase keys, the binary search can return false for a key that is present. An authenticated tenant owner can bypass configured namespace, Service, or delegated node metadata restrictions. This is fixed in version 0.13.7.

In Rsyslog from 7.5.4 until 8.2606.0, the optional mmpstrucdata plugin's parseSD_PARAM function stores RFC5424 parameter values in a fixed pVal[32 * 1024] stack buffer and calls parsePARAM_VALUE without supplying the destination size. A remote unauthenticated attacker whose crafted RFC5424 message reaches an action using mmpstrucdata can provide a parameter larger than the buffer, causing an attacker-controlled stack overwrite. This is fixed in version 8.2606.0.

In ToolHive prior to CLI 0.30.1 and Studio 0.38.0, locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while ToolHive API and MCP proxy endpoints are reachable without authentication. A malicious or compromised MCP server can use the Docker gateway to contact host-local services, other ToolHive-managed MCP proxies, or the ToolHive control plane without escaping the container. This is fixed in CLI 0.30.1 and Studio 0.38.0.