CVE Vulnerability Catalog

An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas.

A path validation weakness in archive extraction/write handling allows entries with traversal sequences to be written outside the intended build artifacts location.

A deserialization weakness in JFrog Artifactory package handling could allow a low-privileged user to impact confidentiality, integrity, and availability under specific repository conditions.

Incorrect authorization validation in refresh token signature allows non-admin users to obtain a signed JFrog administrator token.

Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory.

Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value.

An event-handling weakness in JFrog Artifactory could expose privileged authorization material to a lower-privileged user under specific conditions.

A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. This out-of-bounds read vulnerability results in information disclosure of heap contents or a crash leading to a denial of service.

A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow, potentially leading to arbitrary code execution or a denial of service.

The cloud-healthcare-fhir-fetch-page tool in googleapis/mcp-toolbox is vulnerable to SSRF and credential exfiltration. An unvalidated pageURL parameter triggers HTTP requests with an Authorization: Bearer header to arbitrary hosts, leaking OAuth tokens.

The Event-Driven Ansible (EDA) server has a vulnerability in ExternalEventStreamViewSet with permissive access controls and reliance on the Subject HTTP header for mTLS authentication without proxy verification. Attackers can inject events into mTLS-protected streams.

Next.js versions 16.0.0-16.2.10 have a vulnerability in applications using App Router with Turbopack and a single entry in config.i18n.locales. Crafted requests can bypass middleware/proxy-based authentication.

Next.js versions 13.0.0-15.5.20 and 16.0.0-16.2.10 have a vulnerability in applications using App Router with at least one Server Action. Crafted requests can cause excessive CPU usage, blocking further request processing.

Roskus Prospero Flow CRM before version 5.4.4 has a Stored XSS vulnerability in the email module. A low-privileged user can store malicious JavaScript in email bodies that are rendered unsanitized, allowing session takeover of administrators.

Pheditor versions 2.0.1-2.0.5 have a vulnerability in the terminal feature with an incomplete character blocklist. Characters |, `, and newline (0x0A) are not blocked, allowing authenticated users to bypass the command allowlist and execute arbitrary OS commands.

Pheditor before version 2.0.5 has a vulnerability in the terminal feature that only checks the start of the command and does not block shell command substitution ($()). Authenticated users can bypass the command allowlist and execute arbitrary OS commands.

PostCSS versions up to 8.5.11 have a vulnerability where the PreviousMap parser reads the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem without scheme, allowlist, or traversal checks. An attacker controlling CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes via a JSON.parse SyntaxError message. The bug also provides a precise file-existence oracle and a controllable-read primitive that can be combined with large files for DoS. The issue is triggered with default PostCSS options and is reachable from any pipeline processing untrusted CSS through PostCSS.

An improper access control vulnerability in Devolutions Server allows an authenticated non-administrative user with user-group membership management permission to escalate privileges to administrator via a crafted API request. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier.

A denial-of-service vulnerability in facil.io 0.7.5 through 0.7.6 in the HTTP/1.1 chunked transfer encoding parser allows unauthenticated remote attackers to crash the server by sending a negative chunk size value, causing memory corruption and a fault.