CVE Vulnerability Catalog

Out-of-bounds read vulnerability in the image codec module. Successful exploitation may affect service confidentiality.

A missing authentication vulnerability in ICU Scandinavia Boomerang's device receiver endpoints allows an unauthenticated remote attacker to read full facility configurations and write unauthorized data to the sensor database.

A flaw in Samba's pam_winbind, when mkhomedir is enabled, fails to validate the home directory path before chowning it. This allows a non-root user with narrow sudo delegation to change ownership of the root directory (/), causing severe denial of service (SSH, sudo, and package-manager failures) without granting write access.

Grav v2.0.0 contains a cross-site scripting vulnerability, fixed in 2.0.1. The XSS blueprint validator (Security::detectXss()) runs on raw page content before Twig processing. When Twig content processing is enabled (twig_content.process_enabled: true), an attacker with page-write API permission can use Twig's string concatenation operator (~) to dynamically construct event handler names, dangerous tag names, or dangerous protocols at render time (e.g. {% set x = "on" ~ "error" %}). The validator sees only the harmless Twig expression and allows the content, but after Twig rendering the output (rendered via {{ page.content|raw }}) contains an active payload such as <img src=1 onerror=alert(1)>, executing arbitrary JavaScript in visitors' browsers.

The Grav API plugin (getgrav/grav-plugin-api) before version 2.0.4 contains an improper session invalidation vulnerability. JWT access tokens are issued without a jti (JWT ID) claim, making them impossible to revoke server-side.

Grav 2.0.1 contains a decompression-bomb size-cap bypass in ZipArchiver and GPM\Installer. An attacker can supply a crafted ZIP archive with forged small entry sizes that bypass the limit, while extraction writes the actual much larger content, leading to disk or inode exhaustion.

A vulnerability in PraisonAI Platform before version 0.1.9 allows workspace members to rename and recolor shared labels and add/remove labels on owner-created issues. Attackers with member privileges can exploit PATCH and POST/DELETE endpoints to alter shared label taxonomy without owner or admin authorization.

The vulnerability in PraisonAI before version 1.6.78 caches tool approval decisions solely by tool name, allowing attackers to reuse initial approvals for subsequent calls with arbitrary arguments. Attackers can exploit this by obtaining approval for a benign operation and then executing dangerous file write operations with unreviewed parameters in the same session.

A permission bypass vulnerability in n8n before versions 1.123.61, 2.27.4, and 2.28.1 affects external secrets handling. An authenticated user with credential create or update permissions but without the externalSecret:list scope can embed external secret references into credentials that static validation does not detect; these references resolve at workflow execution time, exposing secret values.

In n8n before version 2.28.1, an information disclosure vulnerability exists where external secrets are incorrectly resolved in workflow node expressions outside the credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

A vulnerability in Prospero Flow CRM before version 5.14.0 allows an authenticated user to bypass authorization via a user-controlled key (CWE-639) in the Excel import functionality. An attacker can create customer, lead, and product records in another company's tenant by uploading a spreadsheet with a manipulated company_id column.

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0, the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials.

A vulnerability in n8n before version 2.19.3 allows bypassing file access restrictions in the legacy ExecuteWorkflow node. An authenticated user with permission to create or modify workflows can supply an arbitrary file path to check for file existence on the host and, if the file is a valid workflow JSON, load and execute it.

In n8n before version 2.10.0, an input validation vulnerability in the Guardrail node allows attackers to bypass default guardrail instructions. End users can craft malicious inputs to circumvent guardrail protections and compromise workflow integrity.

A vulnerability in Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7 and 9.11.0.0 through 9.13.0.2 is due to improper privilege management. It allows a local attacker with high privileges to escalate privileges.

The Kali Forms WordPress plugin before version 2.4.17 lacks a per-object capability check in its post-duplication AJAX action, allowing users with Contributor-level access or above to duplicate any post (regardless of owner, post type, or status) into a published post they own and read its private post metadata, including secrets stored by the plugin.

The Kali Forms WordPress plugin before version 2.4.17 does not verify that a file upload is associated with an existing form configured with a file-upload field, allowing unauthenticated users to upload files to the WordPress Media Library. Uploads are limited to default-allowed MIME types, so code execution is not possible.

An out-of-bounds read vulnerability in ASUS System Control Interface v3, ASUS System Control Interface, and ASUS Business Manager allows a local administrator to read memory regions beyond the intended firmware boundary by sending a crafted IOCTL request that bypasses validation.

An SQL Injection vulnerability in the web management interface of certain ASUS router models allows a remote authenticated user to disclose confidential information via a crafted request that bypasses existing input validation.

The firmware of EC71 v4 and EC70 v4 cash registers contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract the embedded key.