CVE Vulnerability Catalog

In Actual app in OpenID multi-user mode, disabling a user only blocks future OpenID login, but existing session tokens remain valid. The session validation does not check if the user is still enabled, allowing a disabled user to continue accessing authenticated endpoints.

The application contains a stack-based buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code.

The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted files. This could allow an attacker to execute arbitrary code in the context of the current process.

The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to write data past the end of an allocated memory buffer. This can lead to arbitrary code execution.

LocalAI has an unauthenticated server-side request forgery vulnerability in the POST /models/apply endpoint, allowing attackers to fetch arbitrary internal URLs. Unsanitized gallery URL fields are passed directly to gallery.GetGalleryConfigFromURLWithContext, enabling HTTP GET requests to private and loopback ranges with partial response leakage via error messages.

FluxInk (formerly Sunia SPB Peripheral) Color Management Driver TcnPeripheral64.sys version 1.0.7.2 allows local privilege escalation for a standard user account via arbitrary physical memory mapping at \Device\PhysicalMemory. Fixed in version 1.0.7.6, available in Windows 11 25H2 HLK or via Windows Update.

GNU Wget through version 1.25.0 contains a heap buffer underread vulnerability in the clean_metalink_string() function within src/metalink.c. A malicious server can trigger memory corruption by serving a Metalink document with a whitespace-only URL, causing a pointer to decrement past the buffer start.

In DataEase prior to version 2.10.24, a vulnerability exists due to a hardcoded default share link signature key. An attacker who knows this key (link-pwd-fit2cloud) can forge JWT tokens and access backend resources as the share creator, even after the original share has been revoked.

In DataEase before version 2.10.24, chart quota and Y-axis filters embed attacker-controlled filter values directly into generated SQL in Quota2SQLObj.getYWheres() without applying the SQL literal validation and escaping used by other filter paths, allowing an authenticated user who can create or modify chart definitions or submit chart data requests containing quota filters to inject SQL into queries executed against configured datasources.

In DataEase prior to version 2.10.24, a bypass of the H2 zip protocol and file dropper fix allows an authenticated attacker to upload a zip archive disguised with a .ttf extension through FontManage.saveFile and then exploit it through the zip protocol to achieve remote code execution.

In DataEase prior to version 2.10.24, the font management module allows authenticated users to submit an arbitrary fileTransName when creating a font record; when the record is later deleted, the backend concatenates that stored value with the font storage directory and passes it to FileUtils.deleteFile() without path traversal sanitization, allowing deletion of arbitrary writable files in the application container.

In DataEase prior to version 2.10.24, a vulnerability allows bypassing H2 database JDBC URL validation using special Unicode characters with different case-conversion behavior. Attackers can smuggle dangerous parameters like init in malicious JDBC strings, leading to arbitrary code execution.

In DataEase before version 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit permission validation, allowing any authenticated user to execute arbitrary SQL statements on the built-in engine database and read sensitive core data.

In DataEase before version 2.10.24, an authenticated user can download, delete, retry, or generate download links for export tasks belonging to other users by manipulating the task ID parameter. Additionally, the /exportCenter/download/{id} endpoint is whitelisted from authentication, allowing unauthenticated access to exported files.

A vulnerability in calibre prior to version 9.10.0 allows arbitrary Python code execution via a malicious EPUB, OPF, or PDF file. An attacker can embed a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter.

In DataEase prior to version 2.10.24, the share mode chart data interface fails to validate whether tableId and field IDs in the request belong to the shared resource. An attacker with a valid share link token can replace dataset identifiers and retrieve unauthorized data via the POST /de2api/chartData/getData endpoint.

In DataEase before version 2.10.24, the /de2api/share/proxyInfo share interface generates and returns the X-DE-LINK-TOKEN before validating the share password or ticket. This allows unauthenticated attackers who know a protected share UUID to obtain a valid link token for subsequent share-related API calls even with missing or invalid credentials.

In Actual up to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call endpoints like /delete-user-file, /reset-user-file, and /user-create-key because requireFileAccess treats ordinary shared access as sufficient for these operations.

Serena before version 1.5.2 exposes an unauthenticated Flask API on a fixed, predictable port, with no CSRF protection and no Host header validation. A DNS rebinding attack allows a malicious webpage to write arbitrary content to the agent's persistent memory, which combined with shell command execution leads to remote code execution.

In Coder before versions 2.29.7 and 2.30.2, the `dotfiles` registry module passed unsanitized user input to shell commands, allowing arbitrary code execution inside a provisioned workspace. An attacker could supply a crafted `dotfiles_uri` (e.g., containing shell command substitution like `$(...)`) to achieve command execution in their own workspace. The Create Workspace page's `mode=auto` deep links amplified this into a one-click attack without user confirmation.