CVE Vulnerability Catalog

In Velocidex Velociraptor below version 0.76.5, the GetUserRoles gRPC endpoint has an authorization bypass vulnerability (CWE-639). Any authenticated low-privilege user can retrieve the complete ACL policy (roles and permissions) for any user across all organizations by supplying targeted Name and Org parameters.

An off-by-one error (CWE-193) in the ConsumeUnit16Array and ConsumeUnit64Array functions in Velocidex Velociraptor before version 0.76.5 on Windows and Linux allows a local attacker to cause a Denial of Service (DoS) via a process crash by providing a specially crafted .evtx file to the parse_evtx VQL plugin.

Jupyter Server up to version 2.17.0 persists the secret used to sign authentication cookies to a static file and does not rotate it after a password change. After a password reset and server restart, previously issued cookies remain valid, allowing an attacker who captured a session cookie to retain access despite the password change.

Dify before version 1.14.0 contains an authorization bypass vulnerability that allows authenticated users to read the full contents of files uploaded by other users within the same tenant by supplying an arbitrary file UUID in the chat-messages request.

lxc, a Linux container runtime, has a logic flaw in the find_line() function of the setuid helper lxc-user-nic, allowing an unprivileged user to delete OVS-attached network interfaces belonging to other users. This affects multi-tenant environments using OpenVSwitch bridges. An attacker can repeatedly disconnect networking from containers of other tenants, causing denial of service. The issue is fixed in version 7.0.0.

Incus before version 7.0.0 sends a HEAD request to a user-supplied URL before validating project restrictions. An authenticated attacker can force the daemon to make blind HEAD requests to arbitrary destinations, leaking server metadata and enabling internal service probing.

FluentCMS 1.2.3 is vulnerable to XSS in the TextHTML plugin. An attacker can inject malicious script that executes in the victim's browser.

In PhpSpreadsheet versions 1.30.3 and earlier, 2.0.0-2.1.15, 2.2.0-2.4.4, 3.3.0-3.10.4, and 4.0.0-5.6.0, the HTML Writer skips htmlspecialchars() escaping when a cell uses a custom number format containing @ with literals. An attacker controlling cell content can inject HTML and JavaScript.

In Sandboxie-Plus versions 1.17.2 and earlier, HashPassword incorrectly converts SHA-1 digest to hexadecimal, reducing entropy from 160 to 80 bits, making password brute-force easier.

Vaultwarden version 1.35.4 and earlier is missing the has_full_access() authorization check on the get_org_collections_details endpoint (GET /api/organizations/{org_id}/collections/details), which exists on the sibling get_org_collections endpoint. This allows any Manager-role user with accessAll=False and no collection assignments to retrieve names, UUIDs, user-to-collection mappings, and group-to-collection mappings for all collections in the organization. The issue has been fixed in version 1.35.5.

FacturaScripts up to version 2025.92 fails to validate the 'nick' parameter during a POST request to the EditUser controller. Although the UI prevents editing this field, an attacker can intercept the request and modify the parameter to rename any account, including the administrator.

Sandboxie versions 1.17.2 and earlier contain a local denial of service vulnerability in the kernel driver. An unprivileged process in a Standard Sandbox can send a malformed IOCTL to the \Device\SandboxieDriverApi driver, causing an immediate kernel crash (BSOD). The vulnerability affects Standard Sandbox configuration but not Security Hardened Sandbox. Fixed in version 1.17.3.

Tunnelblick to otwartoźródłowy interfejs graficzny dla OpenVPN na macOS. W wersjach od 3.3beta26 do 9.0beta01, każdy lokalny użytkownik może odczytać dowolne pliki należące do roota, wykorzystując podatność na symlink w tunnelblick-helper, dostępną przez gniazdo Unix tunnelblickd z dostępem dla wszystkich.

Vaultwarden versions 1.35.4 and earlier have a vulnerability in the WebAuthn authentication flow. The validate_webauthn_login() function updates persistent credential metadata (backup_eligible and backup_state flags) based on unverified authenticatorData before signature validation. An attacker who knows the user's password but cannot produce a valid WebAuthn signature can permanently modify the backup flags for that credential. If signature verification fails, the database update is not rolled back. This can lead to persistent denial of service of WebAuthn two-factor authentication. Fixed in version 1.35.5.

In OpenStack Horizon versions 25.6 and 25.7 before 25.7.3, a write operation to the session storage backend occurs before authentication, allowing unauthenticated requests to exhaust storage. This is a regression of the CVE-2014-8124 fix.

ERPNext version 15.103.1 and earlier is vulnerable to Cross-Site Scripting (XSS) in the Email Template engine. An attacker with permission to create or edit email templates can inject malicious JavaScript code that executes in the victim's browser when the template is applied.

In Langchain-Chatchat up to version 0.3.1.3, a vulnerability involves missing authentication in the Compatible File Service component. Functions files/list_files/retrieve_file/retrieve_file_content/delete_file in openai_routes.py lack authentication. The attack requires local network access. The exploit is public.

W jądrze systemu Linux zidentyfikowano i rozwiązano podatność związaną z mylącą nazwą funkcji '__copy_user_nocache()'. Funkcja ta, mimo że twierdziła, że jest to kopiowanie użytkownika bez pamięci podręcznej, w rzeczywistości nie spełniała tych założeń i była źródłem nieporozumień w kontekście jej użycia.

W jądrze Linuxa zidentyfikowano podatność związaną z funkcją platform_get_irq_byname(), która może zwracać wartość ujemną w przypadku błędu. Należy to sprawdzić przed przekazaniem do devm_request_threaded_irq().

A vulnerability in the Linux kernel related to not releasing the workqueue when freeing an object for a DSA/IAA device has been fixed.