CVE Vulnerability Catalog

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdown_extensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation source may bypass TechDocs sanitization and cause Python objects to be imported and instantiated in the generator runtime, leading to arbitrary code execution. Earlier fixes in versions 1.14.6 and 1.15.4 did not fully address the supported mapping representation of markdown_extensions. Impact is greatest when documentation generation runs with backend credentials, filesystem access, or internal network access.

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an authenticated user who can register or modify documentation sources to execute arbitrary commands in the build environment. Impact is limited to resources accessible to the TechDocs backend or build container.

Backstage, an open framework for building developer portals, prior to version 1.14.6 contains a remote code execution vulnerability in the @backstage/plugin-techdocs-node package. An authenticated user who can register catalog entities can provide a crafted mkdocs.yml with markdown_extensions, causing arbitrary OS command execution on the TechDocs build host. This issue is fixed in versions 1.14.6 and 1.15.4.

A heap-based buffer overflow exists in GIMP's GIF export plug-in. Exporting an image with very large width and height can cause a 32-bit overflow when computing the pixel buffer size, leading to an integer overflow and a mismatch between allocation and actual write by GEGL.

Coturn 4.10.0 contains an uninitialized memory disclosure vulnerability that allows remote unauthenticated attackers to leak stack memory contents by sending a TURN Allocate request without credentials. The stun_init_error_response_common_str() function fails to zero-initialize the avalue buffer before computing its length and copying leaked stack bytes into the ERROR-CODE reason phrase.

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, the cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user-supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user-supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

The management portal's diagnostic ping tool of Fanvil x7a firmware version 2.6.0.1182 does not handle user supplied input securely. The lack of secure user input handling allows any unauthenticated attacker to inject commands and run code in the underlying Android operating system.

The request handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce any cross-origin resource protection for any state-changing request performed against the applications. Due to the lack of protection, the cross-origin boundary can be completely bypassed, allowing for Cross-Site Request Forgery Attacks against any endpoint.

The websocket handler of Fanvil x7a firmware version 2.6.0.1182 does not enforce proper authentication restrictions against sessionless users. The lack of restrictions grants anyone the ability to view any device resources such as operational logs or perform diagnostic requests.

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user-supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log component.

An issue in iTerm2 macOS before 3.6.12 allows a local attacker to obtain sensitive information.

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_cut_tail() in libntfs-3g/index.c that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by creating a file in a specially crafted directory.

In NTFS-3G before 2026.7.7, an out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly confidential information from ntfs-3g process memory by crafting a malicious NTFS image. The out-of-bounds read is triggered by a readlink on a corrupted file.

In NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap memory in the SUID-root ntfs-3g binary by crafting a malicious NTFS image. The overflow is triggered by extending a directory, e.g., by creating a file.

In wger prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slot_entry ID in a POST /api/v2/workoutlog/ request. The slot_entry foreign key is not included in ownership verification, and the injected data is silently folded into the victim's progressive-overload calculations, corrupting auto-generated targets.

In wger prior to version 2.6, a vulnerability in the authentication/session lifecycle allows bearer-style API credentials to remain valid after a user logs out and after a password change. An attacker who steals a DRF authtoken or JWT refresh token can continue to access protected /api/v2/* endpoints until the token is manually rotated/deleted or naturally expires.

wger, a free workout and fitness manager, prior to version 2.6 contains a vulnerability allowing a user with only the `gym_trainer` permission to deactivate any account in the same gym, including `gym_manager` and `general_gym_manager` accounts. The `UserDeactivateView` grants access to anyone holding any one of `gym.manage_gym`, `gym.manage_gyms`, or `gym.gym_trainer` (OR logic) without privilege-hierarchy checks. Version 2.6 fixes the issue.