CVE Vulnerability Catalog

Gotenberg is a PDF file API that prior to version 8.30.0 had a vulnerability allowing the bypass of ExifTool's metadata write blocklist. Using ExifTool's group-prefix syntax, an attacker could rename, move, and create hard and soft links on the server.

DevSpace is a developer tool for cloud-native development with Kubernetes. In versions prior to 6.3.21, the DevSpace UI server accepted WebSocket connections from all origins, exposing several endpoints to attack.

MagicMirror² is an open source modular smart mirror platform. Prior to version 2.36.0, there is a Server-Side Request Forgery (SSRF) vulnerability in the /cors endpoint that allows remote attackers to force arbitrary HTTP requests to internal networks and localhost services.

Gotenberg is a stateless API for PDF files that prior to version 8.31.0 did not properly check tags, allowing remote attackers to move, rename, and change permissions for arbitrary files.

Nerdbank.MessagePack is a MessagePack serialization library that prior to version 1.1.62 contained an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload could declare an oversized timestamp extension length, leading to an attacker-controlled number of bytes being allocated on the stack.

Wasmtime versions 30.0.0 through 36.0.8, 43.0.2, and 44.0.1 contain a vulnerability where allocation logic for WebAssembly tables panics on overflow. This panic can be triggered when allocating extremely large tables (64-bit range via memory64 proposal). An attacker can cause a denial of service by providing a WebAssembly module or component that requests such a large table.

STIGQter is an open-source reimplementation of DISA's STIG Viewer. In versions from 0.1.2 to before 1.2.7, an attacker can achieve local code execution (LCE) with the privileges of the user running STIGQter, requiring user interaction.

RMCP is an official Rust SDK for the Model Context Protocol. In versions prior to 1.4.0, the rmcp crate's Streamable HTTP server transport did not validate the Host header, allowing a malicious public website to send authenticated requests to an MCP server running on the victim's loopback or private-network interface via a DNS rebinding attack.

OpenBao is an identity-based secrets management system. Prior to version 2.5.3, when the initial namespace deletion fails, subsequent retries do not properly remove all data before marking the namespace as deleted.

Vvveb before version 1.0.8.3 contains an unrestricted file upload vulnerability in the plugin upload endpoint that allows super_admin users to execute arbitrary PHP code by uploading a malicious plugin ZIP file. Attackers can craft a ZIP containing a plugin.php with a valid Slug header and a public/index.php file with arbitrary PHP code, which executes as the web server user once accessed via subsequent unauthenticated HTTP requests to the plugin's public path.

Vvveb before version 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

CFEngine Enterprise and Community before versions 3.21.8, 3.24.3, and 3.27.0 have a vulnerability allowing command injection.

Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potentially resulting in arbitrary code execution.

In PostgreSQL libpq, the lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions use the inherently dangerous PQfn(..., result_is_int=0, ...) function, allowing the server superuser to overwrite a client stack buffer with arbitrarily-large data. Like gets(), PQfn stores arbitrary-length data into a buffer of unspecified size. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

An integer wraparound vulnerability in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

CVE-2025-15025 is a vulnerability in the Library Automation System that allows authorization bypass through user-controlled keys. This issue affects versions from 21.6 to before 22.1.

In Stel Order v3.25.1 and earlier versions, there is an unsafe object reference (IDOR) in the '/app/FrontController' endpoint. An authenticated attacker could exploit this vulnerability to access information about any employee by manipulating the 'employeeID' parameter.

The Database Backup plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 2.5.2. The issue arises from the plugin not restricting access to the wp_db_temp_dir parameter, allowing unauthenticated attackers to intercept backup files.

The Database Backup plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to and including 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check combined with a user-controlled backup directory parameter.

The Database Backup plugin for WordPress is vulnerable to unauthorized database export in all versions up to and including 2.5.2. This is due to the plugin not properly enforcing the return value of its authorization check, allowing unauthenticated attackers to export database tables.