CVE Vulnerability Catalog

A vulnerability in the Amazon Athena Query Federation Synapse connector allows an authenticated remote user to inject read-only SQL queries via a crafted table name. Affected versions are v2022.20.1 through v2026.19.1.

A vulnerability in Sigstore Timestamp Authority before version 2.1.0 allows an unauthenticated remote attacker to send requests with random paths or HTTP methods, causing unbounded permanent time-series entries in Prometheus metrics and leading to memory exhaustion.

In the Zeroconf library before version 0.149.16, the _read_character_string and _read_string functions in src/zeroconf/_protocol/incoming.py advance self.offset by attacker-declared RDLENGTH without checking it against self._data_len. Unauthenticated hosts on the local link over UDP/5353 can send a TXT, HINFO, or A/AAAA record with rdlength=65535 and seed DNSCache and ServiceInfo.properties with truncated, attacker-shaped key/value or address records.

Zeroconf before version 0.149.12 contains a vulnerability leading to memory exhaustion and excessive CPU usage. Unauthenticated hosts on the local link over UDP/5353 can send crafted queries with the TC bit set, which are stored in `_deferred` and `_timers` dictionaries without size limits, causing memory exhaustion and quadratic CPU burn.

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.7, DNSCache._async_add inserted every response record into cache without a cap, allowing unauthenticated hosts on the local link over UDP/5353 to multicast valid mDNS responses with unique names and cause memory exhaustion, slower cache lookups, and broken discovery and registration.

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.6, DNSIncoming._log_exception_debug and the four QuietLogger exception-dedup methods stored an unbounded _seen_logs dictionary keyed by attacker-influenced IncomingDecodeError messages, retaining sys.exc_info() tracebacks whose frame locals kept raw packet self.data buffers and allowing unauthenticated hosts on the local link over UDP/5353 to drive memory growth until OOM-killed.

Zeroconf before version 0.149.5 contains a recursion error vulnerability in the `DNSIncoming._decode_labels_at_offset` function. A single mDNS packet with chained compression pointers can trigger a RecursionError that escapes `DNSIncoming.__init__`, causing sustained CPU burn, log flooding, and degradation of mDNS-dependent services for unauthenticated hosts on the local link over UDP/5353.

Pimcore prior to versions 11.5.17 (LTS) and 12.3.7 has a vulnerability in the WordExport export flow. It only checks the word_export feature permission and directly resolves attacker-controlled type/id input without enforcing view permission on page, snippet, email, or object elements, allowing a low-privileged backend user to export document content the user is not allowed to view.

In Shopware prior to versions 6.6.10.18 and 6.7.10.1, the Store API endpoint /store-api/handle-payment does not verify order ownership or guest authentication, allowing a normal customer or guest to trigger payment for another user's order.

In Shopware before versions 6.6.10.18 and 6.7.10.1, SVG files are allowed in the extension whitelist and can be uploaded via the media manager without SVG content sanitization. This allows malicious JavaScript (e.g., onload, <script>, <foreignObject>) to execute in the Shopware domain when the uploaded SVG is viewed.

In Shopware before versions 6.6.10.18 and 6.7.10.1, ACL declarations are missing in order state transition endpoints, allowing low-privileged users to modify order, transaction, and delivery states without proper permissions.

In Shopware prior to versions 6.6.10.18 and 6.7.10.1, the upsertUser() method in UserController writes raw user data in SYSTEM_SCOPE without filtering the admin field. This allows a non-admin API user with user:create or user:update ACL permission to set admin: true on new or existing users.

In Shopware before versions 6.6.10.18 and 6.7.10.1, a low-privilege admin user with user_recovery:read ACL can take over any admin account. The root cause is that the hash field in UserRecovery entity is not marked as ApiAware(false) or ReadProtection, allowing the password reset hash to be read via the Admin API.

In Shopware prior to versions 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full administrator by creating an integration with admin: true via the Sync API endpoint POST /api/_action/sync, which lacks proper validation of the admin field.

A vulnerability in SurrealDB before version 3.1.5 fails to apply field-level SELECT permissions to ORDER BY clauses. This allows authenticated users to leak the relative ordering of restricted field values.

A denial of service vulnerability in Helm through version 4.2.3 (fixed in commit ba6c9a2) causes an index out of range panic in the Files.Lines template helper in pkg/engine/files.go. Attackers can include empty files in Helm charts, leading to deterministic render failures during template, install, upgrade, lint, and SDK Engine.Render operations.

Chat2DB before version 5.3.0 contains an insecure direct object reference (IDOR) vulnerability in the GET /api/connection/datasource/{id} endpoint. The handler calls dataSourceService.queryExistent(id, ...) without an ownership check and returns the decrypted password, allowing any authenticated non-admin user to enumerate datasource IDs and read plaintext database credentials of other users.

A vulnerability in Symfony UX (symfony/ux-autocomplete) allows HTML and JavaScript injection by an attacker. The issue occurs in the _createAutocompleteWithRemoteData() method, where AJAX response values are interpolated directly into HTML template literals instead of being treated as text. Affected versions are from 2.2.0 to 2.36.0 and 3.1.0.

A vulnerability in Symfony UX allows CSRF attacks on LiveComponent components. The protection mechanism relies on the Accept header, which can be set by an attacker in a cross-origin request without preflight, enabling unauthorized actions on a victim's session.

A vulnerability in Symfony UX allows arbitrary HTML injection, including <script> tags, during Live Component re-rendering. The client-controlled children[id].tag value is interpolated directly into HTML without escaping or validation.