CVE Vulnerability Catalog

In a particular authentication mode, the reverse proxy forwards requests for a bundled third-party administrative interface directly to it without first applying the gateway's own authentication requirement. All access control for this interface, which manages the credential store gating every other service, is delegated entirely to the third-party login mechanism.

A deployment mode intended to expose only read access to stored data proxies a set of API routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an attacker-chosen identifier, using the application's own elevated backend credentials.

A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service credential can set this header to route around the primary role-based authorization check and reach the alternate path's fixed, elevated role.

An API endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store, without restricting its contents. This allows an authenticated attacker to substitute an arbitrary backend path, causing the application's elevated service credentials to be used against unintended internal endpoints.

An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the destination directory, causing the extraction process to write files to arbitrary locations with the privileges of that process.

A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in the context of the affected application and can redirect the browser to an arbitrary external site.

ZoneMinder versions prior to 1.36.39, 1.38.4, and 1.39.11 allow an authenticated low-privileged user with coarse Events=View and/or Snapshots=View permissions to directly fetch media for events belonging to monitors they are not allowed to access. The normal UI hides the restricted monitor, but direct event media views accept an arbitrary eid and stream media without enforcing event/monitor-level ACL.

Doco-CD is a GitOps continuous delivery tool that automatically deploys and updates Docker Compose projects/services and Swarm stacks. Prior to version 0.90.1, a trust-boundary flaw in OCI artifact verification allowed artifact-provided deployment config to influence the policy used to verify that same artifact. When global OCI signature verification was enabled via `OCI_TRUST_POLICY` (`enabled: true`), an attacker with write access to the configured OCI tag could publish an unsigned or improperly signed artifact containing `.doco-cd.yml` with `oci.verify: false`, causing signature verification to be bypassed and untrusted deployment content to be applied.

Hoverfly prior to version 1.12.8 uses http.DefaultClient without any timeout configuration for remote post-serve actions. When the remote endpoint is unreachable or intentionally slow, each triggered proxy request spawns a goroutine that blocks indefinitely on http.DefaultClient.Do().

Kimai versions prior to 2.58.0 contain authenticated cross-site request forgery issues in their default team creation shortcuts for projects, customers, and activities. These endpoints are exposed through GET routes and directly create or reuse a Team, add the current user as teamlead, and bind the target object to that team.

OpenTelemetry eBPF Profiler starting in version 0.0.202527 and prior to version 0.0.202622 allows an unprivileged process to cause the profiler to open a nonregular mapping file, such as a FIFO, and block indefinitely, preventing further ELF analysis and causing a denial of service.

matrix-sdk-crypto starting in version 0.12.0 and prior to version 0.17.0 was missing a check for the user ID when decrypting an Olm-encrypted event containing the sender_device_keys property. This could be exploited to forge an encrypted to-device event, but only if the attacker colludes with the homeserver operator.

Concrete CMS below 9.5.3 is vulnerable to stored XSS via the Date Format field in the Page Attribute Display block. A user with edit_page_contents permissions could store a payload that executes in the browser of any visitor viewing a page where the block displays a date-type attribute.

Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library block. A user with permission to edit file properties could store a script payload that executes in the browser of any visitor to a page displaying the block with the description or tags column enabled, including unauthenticated visitors.

Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which for file-referencing blocks (e.g., hero_image, gallery) is where the referenced file is authorized against the user's file-manager visibility. This allowed an authenticated user with block-add scope to store and render a reference to a file that would otherwise be rejected, disclosing its URL and preview.

Dobase versions prior to 2026.06.03 have a one-click stored DOM-based XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and never sanitized, allowing execution of malicious code in the browser of anyone with the public share link.

Mousehole prior to version 0.4.05 has its HTTP/WebSocket management boundary reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse (MAM) session cookie and reuses the same cookie-bearing serialization for state, API responses, and WebSocket updates, allowing any client reaching the port to read state, replace the cookie, or force MAM update side effects.

Kimai versions prior to 2.58.0 contain a server-side request forgery vulnerability in the invoice PDF preview and generation workflow. If an attacker controls Markdown content rendered into an invoice PDF, such as Customer.invoiceText, the server-side PDF renderer fetches remote image URLs embedded in Markdown, allowing outbound requests to attacker-controlled or internal targets.

OpenRemote prior to version 1.24.1 allows users with only read:assets privileges to write predicted datapoints via the predicted datapoint write endpoint. Version 1.24.1 fixes the issue.

ArduinoCore-avr versions prior to 1.8.8 allow an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino String object. Passing values near the extremes of the float or double range to String::concat(float), String::concat(double), String::operator+=(), or the + operator causes dtostrf() to write beyond the stack buffer, leading to memory corruption and denial of service.