CVE Vulnerability Catalog

In Vim prior to version 9.2.0450, a heap buffer overflow exists in read_compound() in src/spellfile.c when loading a crafted spell file (.spl) with UTF-8 encoding active. An attacker-controlled length field in the spell file's compound section overflows a 32-bit signed integer multiplication, causing a small buffer to be allocated for a write loop that runs many iterations, overflowing the heap. Because the 'spelllang' option can be set from a modeline, a text file modeline can trigger spell file loading if a malicious .spl file has been planted on the runtimepath.

In Vim prior to version 9.2.0435, an OS command injection vulnerability exists in the :find command-line completion. When the path option contains backtick-enclosed shell commands, they are executed during file name completion. Because the path option lacks the P_SECURE flag, it can be set from a modeline, allowing arbitrary command execution when the user opens a file and triggers :find completion.

FastGPT before 4.14.17 has an inconsistent SSRF protection gap in MCP tool URL handling. Preview/run endpoints reject internal URLs, but create/update endpoints can save an internal URL that is later used without revalidation.

An IDOR vulnerability in AnythingLLM before version 1.12.1 allows an authenticated user to access another user's assistant response in audio form. The GET /api/workspace/:slug/tts/:chatId endpoint does not enforce chat ownership, only workspace membership.

Grimmory, a self-hosted digital library, prior to version 2.3.1 contains a stored cross-site scripting (XSS) vulnerability in its browser-based EPUB reader. This allows an attacker to embed arbitrary JavaScript in a crafted EPUB file. When a victim opens the book, the script executes in their browser with full access to the Grimmory application's session context. This can enable session token theft and account takeover, including administrative access if an administrator opens the affected book. This issue has been patched in version 2.3.1.

Kargo before versions 1.7.10, 1.8.13, 1.9.8, and 1.10.2 is vulnerable to open redirect in the UI OIDC login flow via the 'redirectTo' query parameter.

Postiz is an AI social media scheduling tool. In versions from 2.16.6 to 2.21.6, SSRF protections have a TOCTOU vulnerability: the isSafePublicHttpsUrl() function resolves DNS to validate the IP, but subsequent fetch() calls resolve DNS independently. An attacker controlling a DNS server can exploit this via DNS rebinding to redirect requests to internal network addresses. This issue has been patched in version 2.21.7.

FastGPT versions up to 4.14.11 are vulnerable to DNS rebinding (TOCTOU) in the isInternalAddress() function. The function checks the IP before the HTTP request, but a new DNS resolution during the request may return a different address, bypassing validation. No public patches available.

FastGPT versions up to 4.14.13 have weak resource isolation in the code-sandbox component. Lack of strict OS-level constraints (e.g., cgroups) allows attackers to bypass memory checks and exhaust the JavaScript worker pool, causing a complete Denial of Service (DoS).

Vim before version 9.2.0383 has an OS command injection vulnerability in the netrw standard plugin via a crafted URL (e.g., sftp:// or file://). User interaction is required.

OpenMcdf to biblioteka .NET / C# do manipulacji plikami w formacie Compound File Binary. W wersjach przed 3.1.3 nie wykrywa cykli w drzewie czerwono-czarnym wpisów katalogowych, co może prowadzić do nieskończonej pętli przy przetwarzaniu plików CFB z cyklem w łańcuchu LeftSiblingID / RightSiblingID.

A vulnerability in the Linux kernel related to the lifecycle of the network device has been fixed, where the network device outlived its parent gadget device during disconnection, leading to sysfs link issues and null pointer dereference problems.

A vulnerability was found in the Linux kernel's bh1780 light sensor driver, causing a PM runtime reference count leak on the error path. The issue occurs because pm_runtime_put_autosuspend() is not called when a read operation fails, leading to improper power management state.

Aplikacja Password Pusher, służąca do komunikacji wrażliwych informacji w sieci, miała problem z bezpieczeństwem, który pozwalał na nieautoryzowane tworzenie przesyłek plikowych przez ogólny interfejs API JSON w określonych konfiguracjach. Problem ten został naprawiony w wersjach 1.69.3 i 2.4.2.

A vulnerability has been identified in the Linux kernel related to the load_segments() function, which invalidates the GS base relied upon by KCOV. When CONFIG_KCOV is enabled, calls to instrumented C code can lead to kernel crashes in an endless loop.

W jądrze Linuxa naprawiono podatność związaną z inwersją blokady między mutexami spi_lock i buf_lock w sterowniku spidev. Problem ten mógł prowadzić do zakleszczeń z powodu różnego porządku nabywania blokad w różnych ścieżkach kodu.

A vulnerability has been identified in the Linux kernel related to the call of the generic_handle_irq() function in a non-interrupt context. This issue occurs when resuming the system from suspend on Tegra platforms, leading to a warning in the logs.

A vulnerability in BC-LTS and BC-FJA libraries from Legion of the Bouncy Castle Inc. on X86_64 with AVX and AVX-512f extensions on Linux. The issue involves program files gcm128w, gcm512w, gcm128w.C, and gcm512w.C.

Wykryto podatność w 8421bit MiniClaw, dotycząca funkcji executeCognitivePulse w pliku src/kernel.ts. Manipulacja tą funkcją prowadzi do zdalnego wstrzyknięcia poleceń systemowych.

Vvveb before version 1.0.8.2 contains an unauthenticated reflected cross-site scripting vulnerability in the visual editor preview renderer. Attackers can exploit the 'r' query parameter and '_component_ajax' POST parameter to inject and execute arbitrary JavaScript in the context of the Vvveb origin.