CVE Vulnerability Catalog

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.

Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthenticated attackers to view unpublished draft job positions. Attackers can enumerate sequential provisional references via the ref parameter to read titles, descriptions, salary budgets, and recruiter names and emails.

CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embedded-file 'filename' attributes in XML documents. Attackers can craft a .ctd, .ctz, or .ctx document with an absolute or ~/ filename and no data, so saving embeds files like ~/.ssh/id_rsa into the document.

A vulnerability was determined in a2ui up to 0.12.0 affecting the Root.renderComponentTree function in src/0.8/ui/root.js of the Renderer component. Manipulation can lead to dynamically-determined object attributes, the attack may be launched remotely, and the pull request to fix this issue awaits acceptance.

A vulnerability was found in a2ui up to 0.10.4 affecting unknown code in src/v0_9/basic_catalog/components/Image.js of the Image Player/Video Player/Audio Player component. Manipulation of the url argument results in improper input validation, the attack may be initiated remotely, and the pull request to fix this issue awaits acceptance.

DB Tools rely on the TLS implementation in Golang's standard library, which uses the system CA store and an internal denylist of known-bad CA certificates in the crypto/x509 package. Golang 1.27.3 adds eMudhra certificates to this list, but DB Tools version 100.19.0 was compiled with Golang 1.26.8, which lacks this check. The issue is resolved in DB Tools 100.20.0 by updating to Golang 1.27.3.

From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the synchronous and asynchronous v3 stream get_tree and _fetch_state helpers interpolate caller-controlled assistant_id and thread_id values into authenticated GET request paths without using _quote_path_param. Relative path segments can therefore be normalized into another readable path on the configured server while retaining authentication headers.

Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor reuses one WebSocket and replaces its single websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY_WS.DATA frames to the newest observer without comparing data.id with the subscription operation id, so a caller can receive another user's authorized subscription payload.

From 1.19.10 until 2.1.3, @hono/node-server's serveStatic decodes a request path a second time after Hono has already decoded it for routing, so a malformed percent-encoded sequence can make route middleware evaluate an encoded path while static file resolution uses a different directory. An unauthenticated attacker can bypass middleware mounted on a protected static prefix and read a file inside the configured static root.

From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file.

Prior to 20.14.6, Happy DOM's CookieContainer does not correctly validate or match Domain cookie attributes. It can accept a Domain unrelated to the origin setting the cookie, including a public suffix, and separately treats an unrelated suffix-sharing hostname as a match because cookieMatchesURL does not enforce a DNS-label boundary. In server-side rendering applications, these behaviors can plant and deliver a forged cookie, enabling cookie injection or session fixation.

In the Echo Go web framework prior to 4.15.2 and 5.1.1, Context.Scheme returns values from X-Forwarded-Proto, X-Forwarded-Protocol, or X-Url-Scheme headers without validating that they are supported web schemes. WWWRedirect and NonWWWRedirect use that value to construct a Location header, so an attacker controlling a forwarded scheme header can cause a redirect to use an arbitrary URI scheme. Exploitation requires an affected redirect middleware and user interaction with the response; the HTTPS-specific redirect variants hardcode HTTPS and are unaffected.

In the Echo Go web framework prior to 4.16.0 and 5.4.0, Context.Scheme unconditionally trusts forwarded scheme headers from any client. A client that reaches Echo directly over plaintext HTTP can claim an HTTPS scheme and bypass HTTPSRedirect because the request is treated as already secure. Separately, behind a TLS-terminating proxy that passes an attacker-controlled header, a claimed HTTP scheme can suppress the Strict-Transport-Security header even though the browser receives the response over HTTPS.

In the Echo Go web framework prior to 4.16.0 and 5.4.0, sanitizeURI checks only the first two bytes of a redirect target before deciding whether it begins with an absolute-path separator pair. When AddTrailingSlash or RemoveTrailingSlash is configured with a redirect status, a slash, TAB, separator path form can evade the guard, be emitted in the Location header, and be normalized by a browser into an attacker-controlled host.

In Endatix before 0.7.0, the anonymous POST /forms/{formId}/submissions endpoint stores attacker-controlled JsonData that may contain a file object with an HTTP/HTTPS URL. When a staff member with submissions.view permission triggers file retrieval, the server performs a GET request without validating the destination URL, enabling second-order SSRF to internal services, cloud metadata, and loopback addresses.

In Ember before 1.4.2, interactive TUI row formatters pass Caddy access-log fields, especially the request URI, through fitCellLeft without neutralizing terminal escape or control sequences. An unauthenticated client can place ANSI, OSC, or CSI bytes in an HTTP request that, after decoding, reach os.Stdout and are interpreted by the operator's terminal.

The authentication endpoint generates an error message that reflects request data without sufficient sanitization or encoding, allowing an attacker to inject malicious scripts executed in the victim's browser (reflected XSS).

In Echo before 4.15.3 and 5.2.0, middleware.Static can decode an already decoded Request.URL.Path a second time. Double-encoded separators can be reconstructed before filesystem resolution, reaching a file under a guarded route when static middleware is registered globally.

In Echo before 4.16.0 and 5.4.0, static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the direct path is protected by route-level middleware. This is an incomplete fix for CVE-2026-55677.

In Echo from 4.0.0 until 5.1.0, Context.RealIP falls back to client-supplied X-Forwarded-For or X-Real-IP when Echo.IPExtractor is unset, and the default RateLimiter uses that result as the client identifier. An attacker can rotate forwarded-address values to obtain new rate-limit buckets and bypass IP-based throttling.