CVE Vulnerability Catalog

A vulnerability in MongoDB Server allows an authenticated user with a limited database-scoped role to perform actions on protected system collections that their privileges should not permit. This could result in critical system collections being dropped and recreated without proper authorization.

A vulnerability in MongoDB Server's aggregation framework allows an authenticated user to trigger an out-of-bounds memory read by providing a specially formed numeric parameter in a certain aggregation pipeline stage. This could result in a server crash (denial of service) and may potentially expose a limited amount of memory contents.

MongoDB Server improperly validates request parameters for a Queryable Encryption maintenance operation against the collection's encrypted field configuration. An authenticated user with readWrite privileges can send a specially crafted request causing a server crash or excessive internal writes, leading to resource exhaustion and corruption of encrypted index data.

The AcyMailing plugin for WordPress up to version 10.11.1 has an authorization bypass vulnerability. An authenticated attacker with subscriber-level access can overwrite the BCC field of the acy_notification_cms notification template, causing WordPress password reset emails, including those for administrators, to be silently copied to an attacker-controlled address, enabling account takeover.

Cursor IDE for macOS before version 3.0.0 allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and Dev Containers CLI are installed, to launch a privileged container and mount Docker's virtiofs0, granting read/write access to the user's home directory and enabling host command execution with the user's privileges without an additional permission prompt.

Cursor IDE for macOS before version 3.1.2 allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension invokes outside the sandbox, allowing arbitrary host commands with the user's privileges, including modifying files outside the workspace and launching applications.

Coturn before version 4.17.0 has a vulnerability in turnports_allocate_even() that marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it. An authenticated client can permanently exhaust the relay port pool, causing subsequent allocations to fail with STUN error 508.

Coturn before version 4.16.0 has a vulnerability in dtls_server_input_handler() and create_new_connected_udp_socket() that retain OpenSSL dtls1_reassemble_fragment() state for a 35-byte fragmented ClientHello declaring a 650,000-byte handshake before cookie validation. An unauthenticated remote sender can exhaust memory without TURN credentials, a completed handshake, a valid cookie, or source spoofing.

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the `file_name` form field with no path containment check. Attackers can register an account without email verification, then submit crafted `file_name` values to the `/workspace/file` handler to read host files including application secrets, database credentials, and system files outside the Docker sandbox.

ishankportfolio before version 1.0.1 has a vulnerability due to improperly secured client-side database configuration and insufficient access control policies. Applications using publicly exposed database credentials or permissive database rules may allow unauthorized users to read, modify, or abuse stored form submission data, including personally identifiable information (PII) such as names, email addresses, phone numbers, and messages.

TypeBot before version 3.17.0 allows a low-privilege guest member of a workspace to obtain a live Google Sheets OAuth access token for that workspace by calling the Google Sheets helper `getAccessToken`. The vulnerable path checks only whether the caller has read access to the workspace, decrypts the stored Google OAuth credential, refreshes or retrieves the access token, and returns the raw bearer token directly to the caller. Guests can also enumerate credential identifiers, allowing them to mint and reuse the workspace's Google access token outside Typebot.

TypeBot version 3.16.1 allows an authenticated user with read access to any typebot to resume a WhatsApp preview webhook session that belongs to a different typebot by mixing an authorized `typebotId` and `blockId` and a foreign preview phone number tied to another preview session. The WhatsApp test-webhook handler authorizes the parent typebot first, but then resolves the preview chat session only by `wa-preview-{phone}`. As a result, an attacker can inject arbitrary webhook JSON into another workspace's WhatsApp preview session and advance its draft/unpublished flow without any access to the victim typebot.

Lightroom Classic is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code, but exploitation requires user interaction in that a victim must open a malicious file. The scope is changed.

Lightroom Classic is affected by a Path Traversal vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation requires user interaction in that a victim must open a malicious file, and the scope is changed.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation does not require user interaction.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability. Exploitation does not require user interaction.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Exploit depends on conditions beyond the attacker's control, and the scope is changed.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. The scope is changed.

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.

Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction in that a victim must open a malicious file.