CVE Vulnerability Catalog

Memory Corruption when processing data with large offset and length values exceeds buffer limits during data copy operations.

Memory corruption when processing decode statistics due to insufficient validation of offset against structure size.

Memory Corruption when copying large input data exceeds normal allocation limits.

A DLL hijacking vulnerability exists in the GeoVision GV-Remote E-Map desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searched before the legitimate library location. If successfully exploited, an attacker with local write access to the affected directory could achieve arbitrary code execution in the security context of the GV-Remote E-Map process.

The Affinity by Canva application before 3.3.0 (September 2026 release) did not perform adequate bounds checking when parsing Affinity document files leading to a stack-based buffer overflow. A threat actor could craft a Affinity document that when opened by a user in Affinity could result in arbitrary code execution.

A remote attacker controlling a container registry may redirect a client's token request to a host of their choice and disclose the victim's registry credentials to that host. The vulnerability is fixed in containerization version 0.41.0.

A vulnerability in the djust library (before version 1.0.7) allows an unauthenticated WebSocket client to trigger the import of any Python module via a crafted view path. The import occurs before LiveView class verification and authentication, and the allowed modules list is fail-open by default with loose startswith matching.

djust before version 1.0.7 does not enforce per-object authorization (get_object + has_object_permission) on three render entry points: initial HTTP GET render, SPA url_change navigation, and {% live_render %} embedded child views. An authenticated user can view and act on objects they are not authorized for, a classic IDOR. This is fixed in djust 1.0.7.

joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.

Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to cause denial of service by supplying a crafted comma-separated address list. Attackers can send a single email with a large number of addresses to block the Node.js event loop for extended periods, consuming 100% CPU and freezing the process.

Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorizes the GraphQL draftCreator and revisionCreator fields. Instead of requiring the user-data scope enforced by Gql::canQueryUsers(), these fields are gated only on elements.drafts:read / elements.revisions:read scopes, and their resolver returns a raw User element without per-field authorization. A client with only those scopes can harvest email addresses, usernames, full names, and postal addresses of all draft/revision creators. Fixed in 5.11.0.

Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::renderObjectTemplate() sink remained unsandboxed, and the same fix commit added a self-signing oracle in Cp::elementLabelHtml(). Because Craft/Yii HMAC tokens are not bound to a parameter name, an authenticated low-privilege control panel user with edit rights on a single element type can mint a token over attacker-controlled Twig for the returnUrl parameter and replay it as the redirect POST parameter, reaching the unsandboxed sink and achieving server-side template injection that executes arbitrary PHP code. The issue is fixed in 5.10.13.

Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same key and format used to validate signed redirect parameters, because the HMAC signature is not bound to its purpose. An authenticated, non-administrator user can set the cookie via the license-shun endpoint and transplant the signed envelope into the redirect parameter; on a successful login, Craft validates the signature and renders the authenticated bytes as an unsandboxed Twig template, where Twig's map filter accepts a string callback and allows PHP system() to execute arbitrary operating-system commands as the web-server user. Exploitation requires an account using password authentication without active 2FA, the default request configuration, and availability of PHP system(). The issue is fixed in 4.18.6 and 5.10.13.

AVideo (WWBN/AVideo) through version 29.0 is vulnerable to cross-site request forgery (CSRF). The CSRF protection mechanism is disabled when 'user' and 'pass' parameters are present in the request, but their values are not validated. An attacker can exploit this to modify video records, including ownership transfer, removal of access restrictions, and other changes.

The CloneSite plugin in AVideo through version 29.0 contains a stored OS command injection vulnerability. The stored SSH password is substituted into the command `sshpass -p '{password}' rsync ...` using plain str_replace without escaping, allowing a single quote to break out and inject arbitrary shell commands. Exploitation requires luring an authenticated administrator into planting a malicious password via a CSRF vector, followed by execution via the documented crontab entry.

WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification.

In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns user-group-restricted videos with owner PII to anonymous callers. Attackers can query videos by their public slug to bypass group restrictions and retrieve sensitive user fields including email, phone, address, birth date, and administrator status.

HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() function fails to block internal IP ranges and private addresses. Attackers can send messages instructing the bot to fetch cloud metadata endpoints, localhost services, and RFC 1918 addresses to extract IAM credentials and internal service data.

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive registry credentials or the publication of malicious images. The workflow also exposes the default GitHub token, increasing the severity of the compromise.

In djust prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen session_id with no binding to the authenticated user. An attacker who learns a victim's session_id could connect to the message endpoint and dispatch event handlers executing with the victim's identity and state.