CVE Vulnerability Catalog

A Use-After-Free vulnerability in the PerformanceManager component of Google Chrome prior to version 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue is rated as High severity.

A Use-After-Free vulnerability in the Passwords component of Google Chrome on Windows prior to version 148.0.7778.216 was discovered. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.

In AnythingLLM prior to 1.13.0, the filesystem-search-files agent skill passes its LLM-controlled pattern parameter to ripgrep as a positional argument without a -- end-of-options separator. ripgrep parses any argument starting with - as an option, so a pattern of --pre=/bin/sh turns ripgrep into a script executor, running /bin/sh for each file. Attackers can use this with the filesystem-write-text-file skill to execute arbitrary commands in the AnythingLLM server container.

Better Auth, a TypeScript authentication library, has a vulnerability in its HTTP rate limiter that keys requests by the exact textual IP address from the x-forwarded-for header. An IPv6 attacker can bypass rate limits by rotating through different source addresses or varying the textual encoding of a single address.

A vulnerability in LinkAce before version 2.5.6 allows an attacker to inject malicious mail configuration variables during database setup, leading to remote code execution when emails are sent.

LinkAce before version 2.5.6 contains a stored cross-site scripting vulnerability that allows a low-privilege user to execute arbitrary JavaScript in an administrator's browser session. An attacker can set their OAuth display name to a malicious script and then create an API token, planting a persistent XSS payload in the audit log. When any admin navigates to /system/audit, the payload executes in the admin's browser context.

LinkAce before version 2.5.6 contains an Insecure Direct Object Reference (IDOR) vulnerability in the authorization policy layer. Any authenticated user can modify resources (links, lists, tags, notes) owned by other users via both the web UI and REST API. The root cause is in the update() methods that incorrectly allow editing resources with public or internal visibility regardless of ownership.

Multiple path traversal vulnerabilities were found in go-billy prior to version 5.9.0. Insufficient path sanitization and boundary enforcement allow crafted paths (e.g., using ..) to escape intended base directories. The issue is fixed in version 5.9.0.

Portainer Community Edition versions 2.33.0 through 2.33.8, 2.39.2, and 2.41.0 accept JWT tokens via the ?token= URL parameter, leading to token leakage through proxy logs, browser history, and Referer headers. A leaked token grants full user privileges until expiration (default 8 hours).

In Portainer Community Edition from version 2.33.0 to 2.33.7, there is a vulnerability due to a missing return statement after a token validation error in the kubeClientMiddleware layer. This causes a request with an invalid token to be forwarded to the Kubernetes cluster, bypassing authorization checks.

Portainer Community Edition versions 2.33.0 through 2.33.7, 2.39.1, and 2.40.0 have a vulnerability in the Disable bind mounts security setting for non-administrators. The enforcement check only inspected the HostConfig.Binds array, ignoring the equivalent HostConfig.Mounts array, allowing authenticated users to mount arbitrary host paths into containers.

A vulnerability in Portainer Community Edition allows bypassing seven EndpointSecuritySettings restrictions when creating Docker Swarm services. These restrictions are enforced on the standard container creation path but not applied on the Swarm service API, enabling unprivileged users to launch containers with dangerous configurations.

In Portainer Community Edition versions 2.33.0 through 2.33.8, 2.39.2, and 2.41.0, the Docker plugin management endpoints (/plugins/*) were not registered with a handler. This allowed standard users with endpoint access to perform privileged plugin operations, including installing and enabling plugins, directly against the underlying Docker daemon.

Lakeside SysTrack Agent versions prior to 11.2.1.28, 11.3.0.38, 11.4.0.24, and 11.5.0.15 contain an out-of-bounds read vulnerability in the Command ID 30 UDP packet handler. A remote attacker can send a specially crafted UDP packet with an invalid memory address at offset 0x4 in the payload, triggering an access violation and causing a denial of service.

An unauthenticated arbitrary file read vulnerability exists in the Usagi-org ai-goofish-monitor application on Windows, specifically in the GET /api/prompts/{filename} endpoint. The vulnerability allows remote attackers to read arbitrary files by supplying absolute Windows paths or backslash-based traversal sequences, bypassing incomplete path traversal guards.

Vulnerability in Oracle Flow Manufacturing (component: Security) versions 12.2.9-12.2.15. A low-privileged attacker with network access via SQL can take over the system.

Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via TLS can cause a hang or frequent crash (complete DoS) of the service.

Vulnerability in the Net Service component of Oracle Database Server versions 23.4.0-23.26.2. An unauthenticated attacker with network access via TLS can cause a hang or frequently repeatable crash (complete DOS) of Net Service.

Vulnerability in Oracle REST Data Services in the Mongoapi component. An unauthenticated attacker with network access via HTTPS can cause a complete denial of service (DOS).

A vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations) allows a low-privileged attacker with network access via HTTP to compromise data confidentiality and integrity. Successful attacks can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all Oracle Payroll data.