CVE Vulnerability Catalog

A vulnerability in Docling Core (versions 2.5.0 through 2.74.0) allows local file:// image references and accepts inline data: content without a decoded-size limit. This may lead to unauthorized file access or excessive memory consumption.

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The .env file contains database credentials, admin passwords, and infrastructure configuration, and is served as a static file at /.env.

The firmware of the EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat up to version 1.46 was found to allow unsecured Bluetooth connections. This vulnerability enables attackers to gain full access to the device without authentication.

A directory traversal vulnerability in the KerOS software of the Kerlink Wirnet iStation 868 allows a remote attacker to read sensitive files via the SNMP update mechanism.

In Centrifugo before version 6.8.4, the unidirectional WebSocket transport with compression enabled enforced message size limit before decompression, but after decompression there was no output cap. This allowed unauthenticated requests to /connection/uni_websocket to trigger high memory and CPU consumption.

Vulnerability in CoreDNS before version 1.14.4 allows a single 28-byte UDP datagram to crash the process when the proxyproto plugin is enabled. The bug is in handling PROXY v2 headers with non-UDP transport.

A vulnerability in cert-manager allows namespace users to create Challenge resources without admission validation, bypassing DNS01 solver selectors and using ClusterIssuer DNS credentials for attacker-controlled provider settings and DNS names, including disclosure of X-Api-User and X-Api-Key headers for acme-dns. Affects versions from 1.18.0 to 1.19.6 and 1.20.3.

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.

An out-of-bounds write vulnerability in the Productivity Suite allows a local attacker to trigger kernel memory corruption via a crafted IOCTL request, potentially resulting in privilege escalation or system instability.

Whistle, an HTTP/HTTPS/WebSocket debugging proxy, contains a vulnerability allowing arbitrary file read. In versions prior to 2.10.3, the GET /cgi-bin/temp/get endpoint improperly validates the filename parameter, enabling an attacker to read system files like /etc/passwd.

In Centrifugo before version 6.8.1, dynamic JWKS endpoint verification could reuse a key for one allowed issuer to verify a JWT for another allowed issuer. This occurred because the JWKS cache and singleflight lookup were keyed only by the JWT header kid, not by the resolved JWKS endpoint, issuer, audience, or trust-domain namespace.

A vulnerability in CrowdSec from version 1.5.0 to 1.7.8 causes HTTP/1.1 requests with Transfer-Encoding: chunked and HTTP/2 requests without a Content-Length header to be processed with an empty request body buffer. As a result, WAF rules targeting REQUEST_BODY, BODY_ARGS, ARGS_POST, JSON, or XML are skipped.

CrowdSec versions 1.7.0 through 1.7.8 have a vulnerability in the LAPI router that globally uses gin-contrib/gzip with DefaultDecompressHandle. This decompresses unauthenticated gzip-compressed JSON request bodies without enforcing a maximum decompressed size, allowing excessive heap allocation that can make LAPI unreachable.

A vulnerability in the Health & Safety (HS) application of NASA's Core Flight System (cFS) allows the application to crash via segmentation fault when processing a routine Housekeeping Telemetry request, leading to denial of service.

Frogman prior to version 1.6.2 stored API tokens as raw hex strings and authenticated the X-Frogman-Token header by comparing it with the stored raw value. This allowed reading active tokens, including admin tokens, from the database and reusing them.

In BigBlueButton prior to version 3.0.21, a vulnerability was found where checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling. This allows a user to send valid requests to some endpoints without a checksum.

BigBlueButton prior to version 3.0.21 generated conference session tokens with insufficiently secure randomness, allowing a session user to predict other users' tokens and impersonate them.

In Emlog version 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed.

In Emlog version 2.6.13 and earlier, the 'keyword' parameter in the admin user search module is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected XSS in an administrator's backend session.

In Manyfold versions 0.96.0 through 0.140.0, authenticated users can rename uploaded files using path traversal sequences. The file app/models/model_file.rb uses user-controlled filenames in File.join(model.path, filename) without proper sanitization, allowing files to be moved or written outside the configured library directory.