CVE Vulnerability Catalog

In Dompdf versions 3.15 and prior, a BMP image is accepted and a PDF-compatible PNG is generated based only on its declared header dimensions, without bounding width × height before conversion via GD. A small BMP (58 bytes) with a header declaring e.g. 6000×6000 causes full pixel canvas allocation, leading to significant memory amplification (up to 12x). This issue is fixed in version 3.16.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 ND Collective Controller is vulnerable to a path-segment injection vulnerability in the collective routing mechanism.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP Response Smuggling due to improper handling of non-standard HTTP version tokens.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontrolled heap allocation.

IBM Aspera Faspex 5 versions 5.0.0 through 5.0.15.4 has addressed a vulnerability related to session management.

IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty are affected by a denial of service vulnerability in the HTTP channel due to unbounded allocation of resources without limits.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the collectiveController-1.0 feature enabled.

IBM WebSphere Application Server 8.5 and 9.0 traditional could allow a remote attacker to execute arbitrary code caused by unsafe deserialization of untrusted data.

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 and the @instana/core component version 6.2.1 are vulnerable to prototype pollution through its configuration normalization API.

IBM WebSphere Application Server 9.0 and 8.5 traditional could allow a remote attacker to obtain sensitive information.

IBM Cloud Pak System 2.3.5.0 could allow a local attacker to obtain sensitive information due to the insertion of credentials into log files.

IBM Langflow OSS versions 1.0.0 through 1.10.1 allow an attacker to reuse another user's FAISS namespace to access owner-only vector content and influence later query results. This causes cross-user information disclosure and limited integrity impact through persistent poisoning of returned results.

SuperPlane before 0.27.0 contains a broken object-level authorization vulnerability in the CanvasService gRPC handlers that allows authenticated users with viewer-level access to one organization to access resources belonging to other organizations by supplying arbitrary canvas or queue UUIDs without organization scoping. Attackers can read cross-tenant execution history and event payloads containing sensitive secrets, write queue items and canvas events into victim organizations, delete arbitrary canvases, and disrupt automation workflows across tenant boundaries.

Dompdf versions 3.15 and prior are vulnerable to a File Existence Oracle attack via manipulation of the CSS @font-face directive. An attacker can exploit the difference in behavior when referencing existing vs. non-existing local files (via file:// protocol) as an oracle to enumerate files on the server, even with CHROOT restrictions. This issue has been fixed in version 3.16.

In Dompdf versions 3.15 and prior, the validateLocalUri() method enforces CHROOT boundaries via a prefix check after path normalization. Because normalization strips the trailing directory separator, the check can be bypassed (e.g., /var/www also matches /var/www2). An attacker controlling part of the rendered HTML can read files outside the allowed directory. This issue has been fixed in version 3.16.

Litestar, an ASGI framework, prior to version 2.20.0 is vulnerable to HTML Injection which can be escalated to Cross Site Scripting (XSS) when a template engine is used with CSRF protection and the CSRF cookie contents are not automatically escaped by the template engine if configured per documentation recommendations.

MikroTik RouterOS contains a weakness in its API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, allowing repeated authentication failures to proceed without defensive response. In some versions, a fixed per-connection delay is present, but it can be bypassed through concurrent sessions, resulting in continued high-volume attempts.

IBM WebSphere Application Server - Liberty versions 17.0.0.3 through 26.0.0.8 is affected by a denial of service vulnerability when the restConnector-2.0 feature is enabled.