CVE Vulnerability Catalog

A vulnerability in the Twig library (versions prior to 3.26.0) allows allocating a large number of ICU formatter objects via template-controlled filter arguments, leading to memory exhaustion. The issue is fixed in version 3.26.0.

In the Twig template language for PHP, the deprecated spaceless filter is registered as safe for HTML, causing Twig autoescaping to emit attacker-controlled markup unescaped when spaceless is applied to untrusted input. This issue is fixed in version 3.26.0.

A vulnerability in the Twig library for PHP (before version 3.26.0) allows untrusted templates to exhaust CPU, memory, or wall-clock time, even under the strictest allow-list. The issue is addressed in version 3.26.0 by documenting that the sandbox does not protect against resource exhaustion.

A server-side request forgery (SSRF) vulnerability has been identified in the mastergo-magic-mcp library up to version 0.2.0. The issue is in the z.string function in the file src/tools/get-component-link.ts, where manipulation of the url argument can lead to requests to arbitrary resources. The attack can be performed remotely, and the exploit has been made public.

A reachable assertion vulnerability in Matter SDK versions 1.3 and 1.4 causes device abort after a MoveToLevel command and conflicting write to the OperationMode attribute. The bug in Level Control cluster server tick logic leads to denial of service (DoS).

In jackson-databind, the UnwrappedPropertyHandler.processUnwrapped() method replays buffered JSON for a @JsonUnwrapped property without a prop.visibleInView() guard, allowing a property annotated with both @JsonView and @JsonUnwrapped to be written from attacker JSON under a less-privileged active view.

DOMPurify prior to 3.4.7 has an IN_PLACE sanitization vulnerability that skips shadow DOM content inside <template>.content. Attackers can inject HTML with event handlers, JavaScript URLs, or scripts that execute when the sanitized template is cloned and inserted.

In Tornado before version 6.5.6, the optional native extension tornado.speedups implemented websocket_mask without validating that the mask argument is exactly four bytes. This allows the C function to read up to three bytes beyond the provided buffer when reached through Tornado XSRF token decoding with the native extension active.

Vulnerability in DOMPurify before version 3.4.6 allows event-handler attributes to be preserved on an attacker-controlled <form> root when using DOMPurify.sanitize(root, { IN_PLACE: true }), enabling XSS attacks.

DOMPurify prior to version 3.4.6 incorrectly handles same-origin foreign-realm DOM nodes with IN_PLACE: true, bypassing sanitization and allowing executable markup to survive.

A vulnerability in sigstore-js (versions prior to 3.1.1) allows an attacker to manipulate the transparency-log timestamp for inclusionProof-only entries in v0.2 bundles. Since the inclusion proof path does not cryptographically bind the timestamp, an attacker can influence certificate validity and timestamp threshold verification decisions.

A vulnerability in sigstore-js (versions prior to 3.2.1) allows mutation of the payload type after signing without invalidating the signature, breaking the type-binding guarantee of DSSE. The preAuthEncoding function uses Node.js ASCII encoding, enabling manipulation of the payloadType field.

ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction and the scope is changed.

Premiere Pro is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction, but depends on conditions beyond the attacker's control.

A ReDoS (Regular Expression Denial of Service) vulnerability in UAParser.js versions 2.0.1 through 2.0.9. An attacker can send a crafted Sec-CH-UA-Model header, causing catastrophic regex backtracking and excessive CPU usage.

Media Encoder is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

A vulnerability in the NVIDIA TensorRT-LLM library has been found in the OpenAI-compatible inference API. An attacker can trigger a reachable assertion in the sampler thread, leading to denial of service.

NVIDIA TensorRT-LLM contains a vulnerability in the gRPC server chat API endpoint, allowing a local attacker to trigger CWE-20 (improper input validation). Successful exploitation could lead to denial of service (DoS).

A vulnerability in symfony/polyfill-intl-idn (versions 1.17.1 through 1.38.1) allows accepting xn-- labels with empty or ASCII-only payload, violating UTS #46 requirements. This can cause different domain names to be considered equal.

NVIDIA TensorRT-LLM contains a vulnerability in the OpenAI-compatible inference API, where an attacker could cause allocation of GPU resources without limits or throttling. A successful exploit of this vulnerability might lead to denial of service.