CVE Vulnerability Catalog

GitHub CLI (gh) versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can become reachable through the user's non-loopback local IP addresses. This issue is fixed in version 2.98.0.

A permissions issue was addressed with additional restrictions in iOS and iPadOS. A malicious app may be able to enumerate installed apps.

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root.

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.

Under specific circumstances, low-level user can run request to remote CocoaPods repos via JFrog Artifactory External Dependency.

When decompressing crafted zip files using the bzip/LZMA/Zstandard compressions, Python could use an attacker-controlled size to pre-allocate memory, possibly resulting in memory exhaustion.

A weakness has been identified in liketrek TREK up to 3.0.22. This impacts the function validateShareTokenForAsset of the component Journey Photo Proxy. Executing a manipulation can lead to incorrect authorization. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.1.0 will fix this issue.

A security flaw has been discovered in liketrek TREK up to 3.0.22. This affects an unknown function of the file server/src/nest/journey/journey-public.controller.ts of the component Public Journey Photo Proxy. Performing a manipulation results in path traversal. The attack can be initiated remotely. The attack's complexity is rated as high. The exploitability is reported as difficult. Upgrading to version 3.1.0 mitigates this issue.

HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the host environment.

A reflected XSS vulnerability in the AshAuthentication library allows an attacker to inject malicious script into HTML pages generated during action confirmation or magic link sign-in. The issue occurs when a strategy has require_interaction enabled and request parameters are embedded into forms without proper escaping.

A path traversal vulnerability was found in peerigon unzip-crx and unzip-crx-3 up to 0.2.0, affecting the unzip function in dist/index.js during archive extraction. Manipulating the destination argument can lead to path traversal. The attack can only be executed locally, and the exploit has been published.

Grav CMS before version 2.0.16 has a timing vulnerability in Utils::verifyNonce() that uses non-constant-time comparison (===) instead of hash_equals() for CSRF nonce validation. Attackers can measure response timing differences to recover valid nonces byte-by-byte.

Adminer versions 4.6.0-5.5.0 (fixed in 5.5.1) have an incomplete fix for an X-Forwarded-Prefix vulnerability. The validation only rejects prefixes starting with '/', but allows values like '/\evil.com' which, after browser normalization, become a network-path reference affecting the Set-Cookie Path attribute.

Faveo Helpdesk up to version 2.0.3 contains a path traversal vulnerability in the unlink function of SettingsController.php (Logo Handler component). Manipulation of the data1 argument allows remote file deletion. The exploit has been publicly disclosed and may be used.

hexpm (hex.pm) has a vulnerability due to insufficient session expiration in the OAuth token refresh grant. A user removed from an organization can still read private packages because permission scopes are not properly updated. Affects hex.pm from 2025-10-10 before 2026-08-24.

Netty prior to versions 4.1.137.Final and 4.2.17.Final has a vulnerability in MqttEncoder that does not validate client identifiers, will topics, usernames, and PUBLISH topic names before encoding, allowing prohibited null bytes in MQTT UTF-8 string fields. This can cause routing, access-control, or identity mismatches in downstream brokers.

A vulnerability has been found in Piwigo 16.3.0 in an unknown function of the Public Authentication Page component. Manipulation of the lang argument leads to cross site scripting. The attack may be performed remotely, but is difficult to exploit. The exploit has been disclosed. Upgrading to version 16.4.0 fixes this issue.

A vulnerability in Apache::AppSamurai::Util versions through 1.01 for Perl: predictable session authentication keys generated from the clock and process id in CreateSessionAuthKey. The function runs five rounds of SHA-256, each over a fresh Time::HiRes reading formatted to six decimal places, the running digest, and the process id. The key is returned to the browser as the session cookie and combined with the server key. An attacker who knows the second of session creation and the PID can enumerate candidate keys and recover the victim's cookie, bypassing authentication.

The Content Mask WordPress plugin before version 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages without holding the publish capability.