CVE Vulnerability Catalog

In EasyAdmin from 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored files for inline same-origin rendering without a download attribute or Content-Disposition attachment header. When uploads are stored under the public web root, an attacker can upload HTML through FileField or SVG through ImageField, and JavaScript executes in an authenticated administrator's origin.

In docx4j before 11.5.14, PropertyResolver and adjacent helpers recursively follow the WordprocessingML w:basedOn style inheritance chain without cycle detection. A well-formed DOCX containing mutually based styles causes unbounded recursion in PropertyResolver.fillPPrStack and related effective-style resolution paths, resulting in StackOverflowError.

In http4k before 4.51.0.0, 5.42.0.0, and 6.49.0.0, ServerFilters.GZip, RequestFilters.GunZip, and the underlying Gzip request-body decompression functions impose no limit on decompressed size. An unauthenticated client can send a small gzip-encoded request body that expands to gigabytes, exhausting the JVM heap.

In dd-trace-rb before 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192), although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption.

In dd-trace-java before 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS (default 64) or DD_TRACE_BAGGAGE_MAX_BYTES (default 8192), although those limits apply during baggage injection. A remote unauthenticated attacker can send a baggage HTTP header containing many comma-separated key-value pairs or a single very large value, causing unbounded CPU and memory consumption.

In Conform from 1.8.0 until 1.19.4, the parseSubmission future API in packages/conform-dom/formdata.ts repeatedly scans FormData or URLSearchParams entries by each unique field name. An unauthenticated attacker can submit a crafted form containing many unique names, causing excessive synchronous CPU work and denial of service.

In XWiki Platform prior to 17.10.5 and 18.2.0, the /skin/ action in SkinAction can resolve double-encoded parent-directory segments outside the intended resource prefix when Jetty 12 or later decodes the request path. An unauthenticated remote attacker can read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and potentially host files. The issue is fixed in versions 17.10.5 and 18.2.0.

In GNU C Library versions 2.38 to 2.44, calling strfmon or strfmon_l can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls these functions with right-justified width padding into a destination buffer large enough for the padding but too small for the internal memmove call. At the time of publication, no network-facing application impact is known.

gRPC-Go prior to 1.82.2 and 1.83.2 allows servers created with xds.NewGRPCServer() to accept an RPC lacking both the :authority and Host headers. RouteAndProcess assumes an authority value exists and indexes an empty slice, causing an index-out-of-bounds panic that terminates the entire server process.

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain vulnerabilities found during an internal security review, related to improper validation of specified quantity in input (CWE-1284).

Laravel MagicLink versions 2.0.0 through 2.25.1 store serialized action objects in the magic_links.action database column and deserialize them without sufficient integrity protection, with an unsafe legacy unserialize() fallback. An attacker able to manipulate database records can insert a malicious serialized object graph and execute arbitrary code when the magic link is visited.

Argos JavaScript SDK before core package version 6.2.1 allows attacker-controlled CI branch or ref values to be interpolated into commands executed by /bin/sh -c. Shell metacharacters in a pull-request branch name can execute arbitrary commands with Argos upload process privileges.

Alchemy CMS before versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6 exposes an unauthenticated GET /api/pages/nested endpoint that returns an unfiltered page tree without authorization. Restricted and unpublished page metadata and element/ingredient content can be retrieved.

gettext-converter before version 1.3.3 in js2i18next() uses dynamic object keys without rejecting __proto__, constructor, or prototype. Converting untrusted translation data can lead to prototype pollution affecting the entire process.

Pimcore before versions 11.5.19, 12.3.10, and 2026.1.6 allows an authenticated user with reports_config permission to inject SQL fragments into report configuration fields. Executing the report can disclose, modify, or delete arbitrary database data.

Pimcore before version 2026.1.5 allows an authenticated user with objects permission to submit a malicious ClassDefinition UID that is used in SQL queries without proper quoting. This can lead to reading or modifying arbitrary database tables, including disclosure of password hashes.

node-opcua before version 2.166.0 stores nonces in a global cache without expiration or size limit. An unauthenticated attacker can repeatedly create sessions with unique nonces, causing unbounded heap growth and crashing the server.

node-opcua before version 2.166.0 in UserNameIdentityToken handling does not verify that trailing bytes match the current serverNonce. This allows an attacker to forge a token with an empty password or replay a captured token in another session.

GIMP when processing a specially crafted lighting preset file does not properly validate the number of light sources in the Lighting Effects filter. This can lead to an out-of-bounds write, potentially causing a crash or enabling arbitrary code execution.

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Scripts execute in the browsers of other users, including administrators.