CVE Vulnerability Catalog

The Dockerfile frontend loaded Dockerfile and .dockerignore files into memory without a size limit. A build context with an oversized file could cause buildkitd to allocate memory proportional to the file size, potentially exhausting memory and terminating the daemon, interrupting other builds.

A malicious frontend can submit an LLB definition that causes buildkitd to panic and terminate, interrupting all builds running on that daemon.

BuildKit may be tricked into performing file actions with special file inodes where regular files are expected. Special files may block operations or, on rootful workers, allow unintended host device access.

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive cache and snapshot identity without validating that they matched the actual layer contents. If a BuildKit daemon with shared or persistent cache first processes such a malicious image, a later build using the victim image may mount the attacker-controlled layer contents as the base image. This can allow code from the malicious image to run in the victim build, for example by replacing a commonly executed path such as /bin/sh. The attacker-controlled code may read build secrets mounted into the build, access other build resources, alter output artifacts, or hang the build. The issue affects both regular snapshotters and lazy-pulling snapshotters such as stargz.

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be cached under that digest and reused by a later victim build, compromising build-input integrity.

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. The Windows.Sysinternals.SysmonLogForward artifact allows the user to specify an arbitrary binary path as a parameter and did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions to run a different binary program than the installed sysmon binary.

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server metadata, which is often used to store site-wide configuration data that should only be updated by the server admin.

The Image Slider Widget plugin for WordPress (image-slider-widget) is vulnerable to stored XSS due to improper neutralization of input during web page generation. This affects versions from n/a through 1.1.130.

In Plane prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A project member can use an issue_id they control in the URL while targeting another user's attachment by its pk UUID. When the attachment is pending and not yet confirmed as uploaded, the PATCH handler sets created_by = request.user and transfers attachment ownership to the attacker.

In Plane prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace, including network=0 (secret/private) projects they were never invited to, and grants them a full Member role (read + write). The resolver checks only workspace-level membership/role and never checks the target project's visibility (network). This collapses project-level tenant isolation within a workspace.

In Plane prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspace without checking membership in the asset's project, allowing a workspace member to download assets from private projects when the asset UUID is known. EntityAssetEndpoint.get is a separate public-anchor endpoint that grants AllowAny access and scopes the lookup only to the anchor's workspace rather than its published entity or project. An unauthenticated caller who knows a valid anchor and an asset UUID can therefore retrieve issue-description or comment-description assets belonging to unpublished or private projects in that workspace.

In Plane prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover.

In Plane prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace, project, or estimate scoping. An administrator or member of one workspace can permanently delete an estimate point belonging to another workspace by supplying the target UUID in a URL under the attacker's own workspace. This creates a destructive cross-tenant IDOR.

In Plane prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{asset_id}/, allowing exfiltration of internally fetched content.

A SQL injection vulnerability was found in onetwothreeneth HospitalManagementSystem in the file transaction_details.php. Manipulating the transaction_id argument allows SQL injection, and the attack can be performed remotely. The exploit has been publicly disclosed and may be utilized.

A SQL injection vulnerability was found in UNION HospitalManagementSystem in the file patient_info.php. Manipulating the patient_id argument allows SQL injection, and the attack can be performed remotely. The exploit has been publicly disclosed and may be utilized.

Plane (open-source project management tool) prior to 1.4.0 contains an XSS vulnerability. IntakeIssuePublicViewSet.create in v1.3.1 writes description_html without calling validate_html_content from nh3. An authenticated user can plant arbitrary HTML in a project with a published DeployBoard and intake enabled, and when a victim clicks the link, JavaScript executes and exfiltrates an API token.

Plane (open-source project management tool) prior to 1.4.0 has a project invitation list endpoint accessible to any authenticated user who knows the workspace slug and project ID. The public invitation join endpoint accepts an invitation based only on a submitted email address. An attacker can enumerate the invitation, register an account using the invited email without mailbox verification, and accept the invitation, adding their account to the target workspace and project.