CVE Vulnerability Catalog

CakePHP Queue is a queue-interop compatible queueing library. From 0.1.11 until 2.3.1, QueueManager::getUniqueId() generates identifiers for jobs with shouldBeUnique enabled from the job class, method, and parameters, but sorting parameter values drops associative-array keys. An unauthenticated attacker who can influence job parameters can submit semantically different data that produces the same identifier, resulting in legitimate jobs dropped as duplicate collisions. Fixed in version 2.3.1.

NLTK before 3.10.3 has a regular expression denial of service vulnerability in Pl196xCorpusReader. Attackers can supply malformed TEI blocks causing quadratic CPU consumption.

NLTK before 3.10.3 has a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment(). Malformed XML files can cause severe CPU consumption and DoS.

openssl_encrypt before 1.4.9 has two weaknesses in the portable USB drive feature. Integrity verification misses files not in the manifest, and a fixed KDF salt enables rainbow-table attacks.

openssl_encrypt (pip package openssl-encrypt) versions up to 1.4.8 do not redact the keyserver bearer token passed as the positional argument to 'keyserver set-token' in the --debug argv dump, because sanitize_argv_for_debug fails to sanitize it. As a result the token is printed in cleartext to stderr under --debug (even without --unsafe-show-secrets), persisting the credential in logs and terminal history. Fixed in 1.4.9.

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verification information displayed to users.

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint terminal output and forge authenticity verification blocks.

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb command's output. An attacker can plant filenames containing terminal cursor-movement and erase-line control bytes that repaint a forged PASSED verdict on screen, masking actual tamper detection. Fixed in 1.4.9 by routing drive-derived names through sanitize_for_display().

openssl_encrypt versions before 1.4.9 fail to sanitize recovery-slot metadata in the desktop GUI, allowing attackers to inject control characters and line separators into the irreversible-removal confirmation dialog. Attackers can craft encrypted files with malicious slot identifiers containing bidi overrides or line-separator characters to forge warning text and deceive users during file removal operations.

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback address still reached the listener while carrying the attacker's host name. A page in a visitor's browser could therefore drive the local server and invoke its company-search and file-detail tools under the Dropbox credential the server holds. Only the network mode was reachable this way; the standard input mode was not. The fix supplies transport-security settings that enable host checking and allow only the loopback name and port, rejecting other hosts before a tool runs. The repository publishes no versions, so the affected boundary is the commit preceding the fix.

Dool in versions up to 1.3.8 is vulnerable to symlink following when the "--devel" flag is used, as the application opens a log file without the "O_NOFOLLOW" flag. A local attacker can exploit this by creating a symlink at the expected log file path pointing to a sensitive file, causing dool to truncate and overwrite the target file with log data, which is especially impactful if dool is run with elevated privileges. The issue was addressed by pull request #116.

HCL IntelliOps Event Management (IEM) is affected by an Admin Session Concurrency Vulnerability. It may allows user sessions to remain active after logout or session deletion.

The CMP WordPress plugin before version 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP plugin's admin-bar controls) to inject arbitrary web scripts that execute when a visitor views the page.

The HCL BigFix Quantum Risk Analyzer binary lacks several critical, industry-standard hardening protections that could allow an attacker to cause a stack-based buffer overflow.

HCL Connections is vulnerable to server-side request forgery (SSRF) when an internal server is compromised, possibly allowing an attacker to send unauthorized requests in certain scenarios leading to information disclosure or security bypass.

HCL BigFix Quantum Risk Analyzer has a validation process that provides overly descriptive error messages when encountering malformed input, which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools.

Weblate prior to 2026.8 allows a user with permission to manage component repository URLs to perform SSRF against internal services through DNS rebinding during VCS operations. Hostname validation uses the first DNS resolution, but VCS clients perform a separate lookup, allowing redirection to an internal address.

Weblate prior to 2026.8 allows an authenticated user to change the account's primary email via PUT or PATCH requests to /api/users/{username}/ without verifying the new address, allowing later team invitations to be accepted without mailbox access.

The Apple profile generated for the Apple built-in Mail, Calendar and Contacts account to synchronize with HCL Traveler requires the Logon Name and Mail Address to be embedded. The values cannot be changed later, and the generation page reflects them back. The profile is not usable without additional info and only allows the attacker to attack their own device, but HCL Traveler could at least check that the values are found in the Domino directory entry for the authenticated user.

Reactor Netty in specific scenarios involving multiple clients with different DNS resolver configurations may incorrectly reuse a previously configured DNS resolver. Affects versions 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.