CVE Vulnerability Catalog

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a conn_id containing a '/' (e.g. 'my_team/conn') to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could retrieve another team's secret by crafting a colliding conn_id. Fixed in 9.28.0 by switching the team-scope separator to '--' and rejecting team-shaped conn_ids when team context is absent. Affects the experimental multi-tenant teams feature only.

libheif versions 1.21.2 and below are vulnerable to a DoS attack via an infinite loop in Box_stts::get_sample_duration(). A crafted 800-byte HEIF file causes 100% CPU usage with no progress, leading to denial of service. The issue occurs during file opening, before any user interaction.

Authorization bypass vulnerability in the Kirki plugin for WordPress up to version 6.0.6. Allows authenticated attackers with subscriber-level access or higher to view all Kirki frontend forms and read stored visitor submission data, including contact details and messages.

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

Discourse prior to versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 contains a vulnerability in the discourse-subscriptions plugin that allows users to gain access to subscription-gated groups without completing payment.

EspoCRM versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents, resulting in stored cross-user XSS. Although inline SVG script is blocked by CSP, same-origin external script is allowed, so an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment and trick another user into opening the SVG to execute JavaScript.

In libheif (versions 1.21.2 and below), a crafted HEIF file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor, leading to an out-of-bounds read and crash (SEGV) on the first frame access. The file parses without error, but crashes when attempting to display.

NULL pointer dereference vulnerability in NanoMQ MQTT Broker versions 0.24.10 and below during high-concurrency reconnect traffic. Causes broker crash (DoS) without authentication. Fixed in version 0.24.11.

A command injection vulnerability in Panabit PAP-XM320 up to V7.7. The management interface calls /usr/sbin/pappiw with user-controlled parameters processed by eval, allowing arbitrary shell command execution.

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another app on the same device to request arbitrary URLs and receive responses with the signed-in user's cookies. Fixed in Firefox for iOS 151.0.

Technitium DNS Server before version 15.0 aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker controlling a domain can cause excessive network traffic.

An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors. On Windows, a symbolic link vulnerability allows a local low-privileged user to escalate privileges to Administrator. During installation, the software writes the file CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ while running with elevated privileges. Because the installer does not properly validate symbolic links or reparse points at the destination path, an attacker can create a malicious link that redirects the write operation to an arbitrary system location, enabling arbitrary file creation or overwrite with elevated privileges.

A same-origin policy bypass exists in the Networking: JAR component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

A Spoofing vulnerability in the Form Autofill component of Firefox and Thunderbird. The issue was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can push malicious remote strategies containing HTML tags, which render in the victim's browser.

A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious restore schedule containing HTML tags.

A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can create a malicious user whose username contains HTML tags, leading to potential phishing attacks.

A Stored HTML Injection vulnerability was discovered in the Credentials Manager functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious identity containing HTML tags, leading to potential phishing attacks.

An Angular template injection vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user with report privileges can define a malicious report containing an Angular template payload.

W Keycloak znaleziono lukę, która pozwala uwierzytelnionemu klientowi wykorzystać podatność Insecure Direct Object Reference (IDOR) w punkcie końcowym API Ochrony Usług Autoryzacji. Znając unikalny identyfikator zasobu (UUID) należący do innego Serwera Zasobów w tym samym obszarze, klient może obejść kontrole autoryzacji.