CVE Vulnerability Catalog

Vulnerability in Hex allows a malicious package publisher or hostile repository server to inject terminal control sequences into Mix task output. Hex prints data from the repository and documentation search service without neutralizing control characters.

SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts untrusted X.509 certificates embedded in CMS SignedData for chain building. Attackers holding a signing key from a sibling intermediate under the same root can embed that intermediate in the signature to install malicious updates.

Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php passes images to GD imagecreatefrom* functions without pixel limits. Remote attackers can upload small, highly compressed images that decode to large bitmaps, exhausting PHP memory and terminating the worker process.

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains an unrestricted file upload vulnerability that allows authenticated back-office users to upload PHP files by appending a trailing space to filenames. FileProcessorService validates the raw filename but FileManager::sanitizeFileName() strips the space, storing an executable .php file under public/cache/documents/ for code execution as the web server user.

Thelia before 3.1.2 and 3.2.x before 3.2.1 contains a CSV formula injection vulnerability that allows unauthenticated visitors to inject spreadsheet formulas by supplying crafted registration, checkout or newsletter fields.

Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticated attackers to reset registered customers' passwords using guest account tokens. Attackers can place a guest order with the victim's email, then use the guest secure key to reset and take over the victim's account when guest checkout is enabled.

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers that skip htl_access hotel checks.

Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by storing unescaped URLs in ExternalImage fields.

Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store crafted YAML via the POST /api/1.0/symbolication endpoint. When occurrences referencing the attacker-controlled symbolication UUID are symbolicated, the stored values are passed to YAML.load with SafeYAML in unsafe mode, enabling arbitrary Ruby object deserialization and potential code execution.

In Quay, an authenticated attacker can access auto-prune configurations of repositories from other namespaces, leading to unauthorized information disclosure. The issue is due to improper enforcement of namespace scoping when retrieving policy details.

A flaw was found in Red Hat Quay where the build trigger management API fails to verify whether a requested trigger belongs to the specified repository.

A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp_put_file.cgi. The manipulation of the argument put_file leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Vulnerability in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N affects an unknown functionality of the Display QR Code Rendering component. Manipulation of the alignment argument results in improper restriction of rendered UI layers. Attack only possible from local network.

A vulnerability has been found in Exponent CMS up to 3.0.2patch2. Affected is the function userLogin of the file xmlrpc.php of the component XML-RPC. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure and did not respond in any way.

A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. Upgrading to version 3.3.5-rc1 will fix this issue. Patch name: 37cd0f27b17cd15cfa4af409bfec943146f5fdfe. Upgrading the affected component is advised.

Thelia 3.0.0's back-office Email/Messages feature contains a server-side template injection (SSTI) flaw allowing any authenticated user with 'Messages' permission to supply unsandboxed Twig templates, executed as raw code. Can lead to full compromise of application and host.

A vulnerability in the hex package manager allows the package owner or an attacker who has taken over the owner's account to publish a new release bypassing the release-age cooldown. The cooldown mechanism that blocks too-fresh versions can be bypassed by retiring the currently locked version, causing the next update to select the new version regardless of its age. Affects hex from 2.5.0 before 2.5.2.

Improper validation of integrity check value in hex allows a package mirror to substitute the tarball that mix hex.package fetch PACKAGE VERSION --output - writes to standard output.

Improper certificate validation in hex allows an attacker who can intercept HTTPS connections and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store to impersonate that host to users who set cacerts_path to a CA store that leaves that CA out.

A vulnerability in rebar3 allows a malicious package publisher to delete a directory outside the project's _build directory and extract package files into it when dependencies are fetched. The app field in Hex dependencies is used without validation as a directory name, enabling paths like ../../../../target. Affects rebar3 from 3.7.0-rc1 before 3.27.2.