CVE Vulnerability Catalog

Electron prior to 41.10.4, 42.5.2, and 43.0.0 did not pass inherited HTML sandbox restrictions to popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click. An untrusted iframe using the allow-scripts allow-popups configuration could open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities.

ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension handler in coders/gif.c. Attackers can craft malicious GIF files that cause the number parser to read uninitialized heap memory and store contents as image metadata, disclosing sensitive heap information.

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.

libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in the expat_realloc() function on 32-bit platforms when computing allocation sizes. Attackers supplying malicious XML to applications parsing with vulnerable libexpat can cause heap buffer overflow, memory corruption, or denial of service.

In KubeVirt, an authenticated user with permission to create Virtual Machine Instances (VMIs) can cause a Denial of Service (DoS) by submitting a virtual machine definition with an empty ephemeral volume. The virt-controller component fails to properly validate the volume configuration, leading to an unhandled exception and application crash during processing. Because the malformed definition persists in the cluster, the controller enters a continuous crash loop, disrupting virtual machine lifecycle operations across the entire environment.

In libsoup, when reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.

In libsoup, when handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable.

Joomla Extension Balbooa Forms before 2.4.3.4 has an unauthenticated path traversal vulnerability that exfiltrates local files through auto-reply attachments. During public form submission, upload-field state is accepted as Guest-controlled JSON. For every object whose 'id' merely looks numeric, the component trusts the supplied 'filename', concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal 'auto reply' and 'attach uploaded files' options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as '../../../../configuration.php' and receive any file readable by the Joomla process.

Joomla Extension Balbooa Forms before 2.4.3.4 has an unauthenticated upload filename stored XSS vulnerability. The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the attacker-supplied original multipart filename verbatim in `#__baforms_submissions_attachments.name`. A later anonymous form submission associates that temporary attachment with the newly created submission. When an administrator opens the submission, the component's JavaScript retrieves the stored attachment record and concatenates `file.name` directly into an HTML string. The complete string is assigned to `innerHTML`.

Balbooa Forms < 2.4.3.4 contains a file metadata tampering vulnerability. The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming, metadata tampering, and path traversal risks (e.g., via getFilePath()).

In the Balbooa Forms extension for Joomla (versions below 2.4.3.4), the public removeTmpAttachment action accepts an attachment ID and deletes the matching database row and file. The controller verifies a Joomla session token, but the model does not bind the attachment ID to the session that uploaded the file, the current user, the form, or the temporary state, allowing any guest to perform unauthorized deletion of attachments.

Stored XSS vulnerability in Wikimedia Foundation Mediawiki - Wikibase Extension allows persistent script injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows data excavation. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Stored XSS vulnerability in Wikimedia Foundation Mediawiki - WikiSEO Extension allows persistent script injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows excessive allocation. Affects versions from 1.46.0 before 1.47.0.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows data excavation. Affects version 1.47.0-alpha.

Missing Authorization vulnerability in the TemplateSandbox extension for MediaWiki allows access to functionality not properly constrained by ACLs. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

Stored XSS vulnerability in the Flow extension for MediaWiki due to improper input neutralization during web page generation. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.