CVE Vulnerability Catalog

A vulnerability in the OSX Broker component of FederatedAI FATE up to version 2.2.0 causes data exposure to the wrong session due to improper handling of arguments rollSiteSessionId, dstRole, and dstPartyId in the QueuePushReqStreamObserver.initEggroll function. The attack can be executed remotely but is considered difficult due to high complexity.

PHPIPAM is affected by an authenticated local file inclusion vulnerability that allows users with access to the API to execute/include arbitrary PHP files on the web server's file system. The API is not enabled by default on installations.

A security vulnerability has been detected in the Streaming Reasoning Tag Filter component of NousResearch hermes-agent up to version 2026.4.30, involving improper handling of case sensitivity in the GatewayStreamConsumer._filter_and_accumulate function. The attack can be initiated remotely but is difficult to exploit due to high complexity. The project decided not to implement a dedicated fix, citing maintenance costs.

The vulnerability in Dell PowerProtect Data Domain involves the use of a less trusted source. It allows a high-privileged attacker with remote access to tamper with information.

Dell PowerProtect Data Domain in multiple versions contains a use of uninitialized resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

Dell PowerProtect Data Domain in multiple versions contains a path traversal vulnerability due to improper limitation of a pathname to a restricted directory. This allows a high-privileged attacker with local access to potentially expose sensitive information.

A vulnerability in CubeSpace CW0057 Reaction Wheel firmware versions prior to 5.0.20 is due to improper verification of cryptographic signatures. This allows an attacker with physical access to upload arbitrary malicious firmware without authentication.

A vulnerability in the SSL library of Erlang/OTP involves improper enforcement of message integrity during transmission. A network-positioned attacker can inject unauthenticated plaintext into a TLS client during the handshake, which is later treated as authenticated server data by the application. The issue affects the tls_gen_connection module and impacts OTP versions from 17.0 to 27.3.4.14, from 28.0 to 28.5.0.3, and from 29.0 to 29.0.3.

The Adminify WordPress plugin before version 4.2.10 fails to perform per-user read-capability checks in one of its administration search features, allowing low-privilege users (Contributor) to disclose non-public content such as other authors' unpublished post titles, pending comment content, plugin inventory, and user account names.

The Fluent Forms WordPress plugin before version 6.2.5 does not properly restrict the deletion of form submission entries to the forms a restricted Manager is authorized to manage. This allows a Manager limited to specific forms to permanently delete submission entries belonging to other forms. This requires a non-default configuration where an administrator has created at least one Manager restricted to specific forms.

A vulnerability in allegroai/clearml versions up to 1.16.5 allows relative path traversal when extracting .zip archives using ZipFile.extractall() in StorageManager._extract_to_cache(). Lack of path validation enables arbitrary file writes.

The Fluent Forms WordPress plugin before version 6.2.1 does not properly verify ownership before processing a subscription cancellation request, allowing authenticated users with low privileges to cancel subscriptions belonging to other users.

UltraVNC repeater up to version 1.8.2.2 contains an off-by-one error in the Base64 decode helper used for HTTP Basic authentication. The wi_uudecode() function in webutils.c:817 uses a strict greater-than comparison (>) instead of greater-than-or-equal (>=), leaving a latent vulnerability. Currently, the risk is limited to a one-byte write at the boundary of a 1024-byte stack buffer.

In runc prior to versions 1.3.6, 1.4.3, and 1.5.0, setupPtmx and setupDevSymlinks use filepath.Join with os.Remove and os.Symlink, allowing an image with /dev as a symlink to delete the ptmx file on the host or create symlinks in an arbitrary host directory. This is not exploitable under Docker, but other container tooling built on runc remains exposed.

A heap use-after-free vulnerability exists in the C engine of the Oj (Optimized JSON) Ruby gem prior to version 3.17.2. The issue occurs when a SAJ/SAJ2 callback mutates the input JSON string during parsing, causing the internal buffer to be reallocated and leaving a dangling pointer.

Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, Oj::Doc iterators (each_value, each_child, each_leaf) were vulnerable to a heap use-after-free. When a Ruby block yielded during iteration calls doc.close or d.close, the document's heap memory is freed while the C iterator is still running. When control returns from the block, the iterator reads from the freed region, producing a use-after-free accessible from pure Ruby.

A heap buffer overflow vulnerability was found in the Oj (Optimized JSON) library for Ruby when serializing Exception objects with a large :indent value. The issue affects versions prior to 3.17.2 and has been fixed in that version.

A vulnerability in ImageMagick before version 7.1.2-24 allows attackers to bypass security policies and create or truncate files that should be blocked. The flaw is due to incorrect policy path validation, enabling file writes outside allowed boundaries.

A vulnerability in ImageMagick before version 7.1.2-22 in the PasskeyEncipherImage method causes AES-CTR nonce reuse. Attackers can exploit this to recover plaintext from encrypted images.

A memory leak vulnerability in ImageMagick before version 7.1.2-19 exists in the PNG encoder when writing MNG images. Attackers can trigger the encoder failure condition to exhaust memory resources and cause denial of service.