CVE Vulnerability Catalog

In Feathersjs version 5.0.44 and earlier, the _.merge function in @feathersjs/commons allows prototype pollution via __proto__, constructor, or prototype keys from JSON.parse.

Statamic CMS prior to versions 5.74.0 and 6.20.3 has a vulnerability in the Live Preview endpoint that only checks view authorization but accepts and renders caller-supplied field values. A Control Panel user with view but not edit permission can submit unauthorized content and generate a shareable Live Preview URL.

IBM Verify Identity Access and IBM Security Verify Access contain an open redirect vulnerability that allows a remote attacker to conduct phishing attacks by using a specially crafted request to redirect a victim to arbitrary websites.

Vulnerability in oras-go library before version 2.6.1. The auth client follows the realm URL from a registry without validation, enabling SSRF attacks to internal networks such as http://169.254.169.254/.

A vulnerability in IBM PowerVM Novalink arises from API misconfiguration, which under non-default conditions may increase the attack surface and enable unintended or unauthorized operations.

In the RustCrypto CMOV library versions 0.1.1 through 0.5.4, the aarch64 implementations of Cmov and CmovEq assume high bits are zero-extended when loading values smaller than a register, which can lead to incorrect results of the cmovz operation.

The Star.text_to_image/NetworkRenderStrategy.render function in the file astrbot/core/star/base.py in AstrBot up to version 4.25.2 is vulnerable to XSS. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond.

The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by an insecure file permissions vulnerability that allows any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary.

The vulnerability in HCL DevOps Loop is caused by insufficient input validation, allowing special characters where they should be restricted. This may result in unintended application behavior under certain conditions.

HCL DevOps Loop is missing HTTP security headers, which reduces browser protections against common web-based attacks such as clickjacking, MIME-type sniffing, and cross-site scripting.

The Lucky 13 vulnerability in HCL Aftermarket EPC allows a man-in-the-middle attack on TLS 1.1, 1.2, DTLS 1.0/1.2, and older SSL 3.0 and TLS 1.0 protocols. An attacker can exploit this flaw to decrypt network traffic.

An out-of-bounds write vulnerability was found in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on on ARM, leading to buffer overflows. The issue is present in the shake.c and sha3.c files under native_c/arm/sha.

A buffer overflow vulnerability in KerOS software of Kerlink Wirnet iStation 868 version 4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the update URLs component.

In CoreDNS from version 1.9.4 to 1.14.5, a network DNS client requesting AXFR zone transfer can trigger a panic when configured with k8s_external headless-service zone transfers and a headless service endpoint with no declared ports. Fixed in version 1.14.5.

In cyrus-imapd up to version 3.12.2, a vulnerability was discovered involving heap exposure during parsing of nested MIME comments. An authenticated IMAP user can craft an email message containing an RFC 822 comment ending with a backslash, causing the server to read past the message's end in memory and return heap content.

In cyrus-imapd up to version 3.12.2, an issue was discovered where URLAUTH does not honor revoked authorizer access. A URLAUTH URL minted while the authorizer had access continued to work after that access was revoked.

In cyrus-imapd up to version 3.12.2, a vulnerability allows GENURLAUTH-issued tokens to bypass ACLs. Any authenticated user can mint a URLAUTH token for any mailbox they can name, even without read access, enabling reading of mail from that mailbox.

In cyrus-imapd up to version 3.12.2, a vulnerability was found in the XAPPLEPUSHSERVICE command. An authenticated IMAP user can probe for the existence of arbitrary mailboxes on other users' accounts and hijack push notifications for new mail in those mailboxes to their own APNS device.

In dbt-mcp before 1.17.1, DefaultUsageTracker.emit_tool_called_event() serializes the complete arguments dictionary of every MCP tool call and sends it via dbtlabs_vortex.producer.log_proto without redaction, including sql_query, vars, and node_selection. Telemetry is enabled by default unless DBT_SEND_ANONYMOUS_USAGE_STATS=false or DO_NOT_TRACK=1 is set.

In dbt-mcp (MCP server for dbt) before version 1.17.1, the call_tool() function logs raw arguments at INFO level, and configure_file_logging() writes them to dbt-mcp.log, potentially exposing sensitive SQL queries, variables, and node selections in plaintext without automatic rotation or deletion.