CVE Vulnerability Catalog

A vulnerability in the Espressif IoT Development Framework (ESP-IDF) allows an out-of-bounds write on the stack when parsing the DQT marker in JPEG files. An attacker can supply a crafted JPEG image, leading to a denial of service.

9Router prior to version 0.5.2 has a vulnerability where it determines whether a /v1 LLM proxy request is local by reading the client-controlled Host header, allowing a remote unauthenticated attacker to send Host: localhost and bypass API-key authentication.

9Router before version 0.5.2 fails to protect the /codex path, allowing a remote unauthenticated attacker to bypass the API-key gate and send requests to /codex/*, which are rewritten to /api/v1/responses. The attacker can exploit this to make upstream provider calls using operator-stored LLM credentials.

The cpp-httplib library versions 0.31.0 through 0.46.1 (Mbed TLS backend) and 0.33.0 through 0.46.1 (wolfSSL backend) skip certificate chain validation when connecting to an IP-literal host in HTTPS mode. This allows a man-in-the-middle attacker to present a crafted certificate and intercept or modify traffic.

The Excelize Go library before version 2.11.0 has a vulnerability in the checkSheet() function that uses an attacker-controlled XML attribute <row r="N"> without validation. A crafted XLSX file can cause massive memory allocation (up to 16 GB) or a panic due to out-of-bounds indexing, leading to denial of service (DoS).

In Lima prior to version 2.1.3, when using the qemu driver, an arbitrary user in the VM could access /run/lima-guestagent.sock with the guest agent enabled. This allowed executing arbitrary commands with root privileges in the VM because the guest agent socket provides tunneling for arbitrary addresses, including Unix socket addresses for privileged daemons like D-Bus.

Grav, a file-based web platform, contains a vulnerability allowing an unauthenticated attacker to exhaust server memory and CPU by requesting oversized image derivatives. The issue is in the `Grav::fallbackUrl` mechanism, which passes request parameters to ImageMedium magic actions without dimension or pixel limits.

In Simple Machines Forum 2.1 prior to commit 7d048f8 and 3.0 prior to commit a7875e8, there is an authorization bypass vulnerability in Sources/Actions/AttachmentApprove.php. A single-character operator error causes the permission check to always pass regardless of user permissions.

The adm-zip library before version 0.5.18 is vulnerable to denial of service via a crafted ZIP file with a manipulated uncompressed size header field. An attacker can create a small ZIP file (about 120 bytes) declaring an uncompressed size of 4 GB, leading to memory allocation amplification of over 33 million to 1, causing a process crash.

A vulnerability in MobilMen 20T by Adam Retail Automation Ltd. allows authorization bypass through a user-controlled key, leading to privilege escalation. Affected versions are from v3 to 10072026. The vendor did not respond to the disclosure.

The SEO Plugin by Squirrly SEO for WordPress up to version 14.0.0 is vulnerable to arbitrary post creation and stored cross-site scripting due to an API token leak and insufficient input sanitization and output escaping. Unauthenticated attackers can create arbitrary posts and, if Advanced Custom Fields is active, inject persistent scripts that execute when users visit affected pages.

An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web root directory.

9Router prior to version 0.5.2 is vulnerable to a DNS rebinding attack. Image URL validation resolves the host before fetching, but the actual fetch performs a separate DNS resolution, allowing an attacker to redirect requests to internal HTTP services.

In 9Router prior to version 0.4.80, the dashboard login rate limiter relies on the attacker-controlled X-Forwarded-For HTTP header. This allows bypassing the 5-attempt threshold and progressive lockout durations by rotating the header value on each login attempt.

In MaxKB prior to 2.10.0-lts, the tool import functionality and MCP referencing mode do not consistently validate MCP transport type, allowing an authenticated user to import a .tool file with stdio transport containing malicious commands and trigger execution via an AI Chat node, leading to arbitrary system command execution.

On Windows, prior to version 5.23.1, a local unprivileged attacker can trigger a heap buffer out-of-bounds write when querying the authenticode table against a maliciously crafted binary. The vulnerability stems from publisher information parsing in the getOriginalProgramName function.

In osquery prior to version 5.23.1 on Windows, a local unprivileged attacker can cause a heap buffer out-of-bounds write when querying the processes table for a maliciously crafted process. The vulnerability is due to unchecked PEB string lengths in process command-line and current-directory reads.

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

In PraisonAI (pip package praisonaiagents) before version 1.6.78, an unsafe dynamic module loading vulnerability exists in AgentFlow._resolve_pydantic_class. When a workflow step uses an output_pydantic reference, the framework imports a sibling tools.py from the workflow file's directory without sandboxing, ignoring PRAISONAI_ALLOW_*_TOOLS environment variables. An attacker controlling a workflow file and its sibling tools.py can execute arbitrary Python code with the workflow runner's privileges.

A vulnerability in PraisonAI before version 4.6.78 allows bypassing the shell command allowlist by using find's built-in actions (-exec, -execdir, -delete). Attackers can execute unauthorized commands, read or delete files without triggering shell metacharacter filters.