CVE Vulnerability Catalog

In Coolify prior to 4.0.0-beta.474, the HMAC key for GitHub webhooks can be null, causing an empty string to be used as the key. An attacker can compute a valid signature and trigger unauthorized deployments.

In Coolify prior to 4.0.0-beta.470, a critical authenticated remote code execution (RCE) vulnerability was found. The flaw is in the handling of the install_command parameter, which is directly concatenated into a shell command during Nixpacks build, allowing arbitrary command execution on the host.

In Coolify prior to version 4.0.0-beta.471, an authenticated command injection vulnerability in the Destination Network Management functionality allows users with network management permissions to execute arbitrary commands as root on managed servers. The "network" parameter is passed directly to shell commands without sanitization, enabling full remote code execution.

A vulnerability in PBackupVSS.exe in Matrix42 Empirum before version 25.5 and 26.x before 26.2 creates a named pipe with overly permissive DACL. An authenticated low-privileged local attacker can connect to this pipe and send crafted IPC messages, leading to arbitrary command execution with SYSTEM privileges.

A vulnerability in JavaScript::Minifier::XS for Perl before version 0.16 causes memory leaks on every call to minify(). The cleanup function only frees NodeSet structures but not per-token content buffers, leading to unbounded memory growth.

A vulnerability in JavaScript::Minifier::XS before version 0.16 for Perl causes a crash via NULL pointer dereference when the first meaningful token of the input is a slash. The issue occurs in the JsTokenizeString function during regexp versus division disambiguation.

A vulnerability in the MDEx library for Elixir/Erlang allows exhaustion of the atom table by processing a specially crafted JSON document. The json_to_node/1 function creates new atoms for each unique node_type value, which are never garbage collected, leading to a crash of the entire BEAM virtual machine.

The issue was addressed with improved checks. A malicious website may exfiltrate data cross-origin.

A use-after-free issue was addressed with improved memory management. Processing maliciously crafted web content may lead to memory corruption.

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5.2, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5.2 and iPadOS 26.5.2, macOS Tahoe 26.5.2, tvOS 26.6, visionOS 26.6, watchOS 26.6. A malicious website may be able to process restricted web content outside the sandbox.

A vulnerability that could allow an app to cause unexpected system termination or write kernel memory. The issue was addressed with improved input sanitization.

Memory management was improved to address a use-after-free issue in Safari and Apple systems. Processing maliciously crafted web content may lead to memory corruption.

A type confusion vulnerability in WebKit that could lead to memory corruption when processing maliciously crafted web content. The issue was addressed with improved checks.

A vulnerability in WebKit allows a malicious website to process restricted web content outside the sandbox. The issue was addressed with improved checks.

A command injection vulnerability in luci-proto-openvpn through version 0.11.1 (fixed in commit e4ff45e) exists in the generateKey ubus method. The cl_meta parameter is interpolated into a shell command without proper escaping, allowing an authenticated LuCI user with OpenVPN configuration access to execute arbitrary commands as root via the popen function.

The luci-app-tailscale-community package contains a command injection vulnerability in the tailscale.do_login RPC method, where user-controlled loginserver and loginserver_authkey parameters are improperly quoted within a double-quoted shell command, allowing authenticated users to execute arbitrary commands as root.

A SQL injection vulnerability in SigNoz through version 0.130.1 allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of alert-history endpoints. Attackers can read all stored traces, logs, and metrics or abuse the url() function for server-side request forgery (SSRF).

A broken access control vulnerability in ruoyi-vue-pro through 2026.05 (fixed in commit 5d1fd70) in ErpSaleOrderController allows attackers with erp:sale-out permissions to gain unauthorized access to sale order operations due to incorrect permission namespace enforcement. Attackers can perform unauthorized create, update, delete, and read operations on financially sensitive sale orders.

An SSRF vulnerability in Pinpoint through version 3.1.0, located in the webhook registration endpoint, allows authenticated users to register internal URLs due to missing SSRF protection. Attackers can trigger alarm threshold breaches to force the server to issue POST requests to internal hosts and metadata endpoints, enabling unauthorized access to internal network resources.

Modoboa before version 2.9.0 has an insecure direct object reference (IDOR) vulnerability in the PUT /api/v1/accounts/{pk}/password/ endpoint. Domain administrators can change any user's password, including superadmins, leading to full account takeover.