CVE Vulnerability Catalog

An out-of-bounds read was found in mrubyc up to release 3.4.1 during builtin missing-method lookup in mrbc_find_method().

In Coolify prior to version 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without the #[Locked] attribute. This allows an authenticated user to enumerate activity records across all teams and read the full command output from remote SSH processes, potentially revealing secrets, configuration files, and infrastructure details.

In Coolify prior to version 4.0.0-beta.471, the Settings/Updates Livewire component does not check isInstanceAdmin in its mount method, allowing non-admin users to access the Updates settings page and potentially modify auto-update settings or trigger update checks.

Coolify prior to version 4.0.0-beta.466 has a vulnerability where mutating API validation endpoints are guarded only by read ability. This allows read-scoped API tokens to perform state-changing operations such as validating cloud tokens and servers.

The showdown library contains a cross-site scripting vulnerability in metadata title handling. When the completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatter metadata are inserted directly into HTML title tags, allowing attackers to inject arbitrary HTML and JavaScript.

A vulnerability in vLLM from version 0.12.0 to before 0.24.0 allows a remote, authorized user to send a /v1/completions request with a model using M-RoPE, causing an assertion failure in EngineCore and a fatal crash of the entire server.

In Traefik prior to versions v2.11.51, v3.6.22, and v3.7.6, the ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header from the original incoming request instead of the sanitized forwarded request. An unauthenticated remote attacker can inject an X-Forwarded-Proto: https header over a plain HTTP connection and cause Traefik to forward X-Forwarded-Port: 443 to the authentication service, bypassing port-based authorization checks.

In Hugo from version 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat, allowing a symlink planted in a local mount (e.g. a vendored themes/ theme) to read arbitrary files accessible to the Hugo user via resources.Get.

DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

FOSSBilling versions 0.6.0 through 0.7.2 have a SQL injection vulnerability in the Massmailer module filter functionality. An authenticated administrator can supply crafted filter values when updating a mass email message, causing untrusted input to be interpolated directly into SQL in the recipient selection query.

Memory corruption occurs when updating prepared commands with invalid port indices from user space input that exceed supported read client limits.

The vulnerability causes memory corruption when validating input batch size and buffer plane count that exceed maximum allowed values.

Memory corruption occurs when handling flash commands due to outdated LED count values being used after userspace modification.

Memory corruption occurs when parsing JPEG commands due to unaccounted extra writes to the buffer during validation checks.

Memory corruption occurs when processing multiple IOCTL calls with the same input buffer file descriptor.

The vulnerability causes memory corruption when processing multiple IOCTL calls with the same buffer file descriptor input, leading to access of already freed memory.

Memory corruption occurs when invoking device I/O control operations for mapping and unmapping persistent memory buffers due to improper synchronization.

A flaw was found in GIMP where the PlayStation TIM loader incorrectly calculates the CLUT size due to an integer overflow. Multiplying two 16-bit unsigned short integers (num_colors and num_cluts) can exceed the maximum integer limit, leading to undefined behavior. An attacker can exploit this by providing a specially crafted image file, causing the plug-in to abort and resulting in a denial of service.

A vulnerability in Hugo from v0.162.0 to v0.163.0 allows bypassing the security policy that blocks requests to loopback, internal, and cloud-metadata IPv4 addresses. The policy only matched dotted-decimal notation, so alternative IPv4 encodings (integer, hex, octal) bypassed the block. When a template passes an untrusted URL to resources.GetRemote and the host uses the cgo system resolver, these encodings resolve to blocked addresses, enabling SSRF attacks to internal services and cloud-metadata endpoints in hosted or CI builds.

A vulnerability in Hugo (versions 0.123.0 through 0.163.0) allows bypassing virtual filesystem security. A bug in RootMappingFs.statRoot causes symbolic links inside mounted directories to point outside the mount tree, enabling reading arbitrary files accessible to the user running Hugo.