CVE Vulnerability Catalog

FOSSBilling versions 0.6.10 through 0.7.2 contain a PHP code injection vulnerability in the Config::prettyPrintArrayToPHP() method. An attacker with admin privileges can inject arbitrary PHP code into config.php, which is executed on every HTTP request.

In FOSSBilling prior to version 0.8.0, suspending or deactivating an account does not invalidate existing authenticated sessions. The session loader does not check the account status, allowing a suspended user to retain full access until session expiry.

In Coolify from version 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom Docker Compose build, start, and pre/post-deployment command fields, allowing an authenticated team member to inject shell commands that execute on the host.

Coolify prior to version 4.0.0-beta.474 contains a command injection vulnerability in the PostgreSQL healthcheck command generation. An authenticated attacker can exploit attacker-controlled database settings (postgres_user and postgres_db) to inject arbitrary commands executed in the database container.

In mrubyc up to version 3.4.1, a NULL pointer dereference was found in the op_super() function in src/vm.c due to a missing runtime guard for top-level super calls.

In Coolify prior to version 4.0.0-beta.471, an authenticated command injection vulnerability exists in the GetLogs Livewire component. Users with team membership (lowest privilege member role) can execute arbitrary commands as root on managed servers.

In Coolify prior to version 4.0.0-beta.471, LocalFileVolume::saveStorageOnServer builds shell commands using unescaped fs_path and parent_dir values before validation, and submitFileStorage does not validate the user-controlled file-mount path before creating a volume. This allows an authenticated user who can add file storage to execute commands when the storage is saved.

Leantime has an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker.

The Users::getUser method in Leantime's JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can enumerate all accounts and obtain credentials for offline password cracking, 2FA bypass, and session hijacking.

Crawl4AI before version 0.9.0 has an SSRF vulnerability in the Docker API streaming path. An unauthenticated remote client can send a POST request to /crawl/stream or /crawl with stream=true, pointing to an internal, private, or link-local address, and the server fetches and streams the response.

A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams.

A vulnerability in the vLLM inference engine before version 0.24.0 allows an attacker to perform a DoS attack by sending a malicious regular expression to the structured_outputs.regex parameter. The expression, lacking compilation timeout and complexity analysis, causes state-space explosion in the grammar compiler, leading to inference worker hang.

Traefik versions 3.7.0 through 3.7.5 have a vulnerability in the Kubernetes Gateway API provider where two accepted HTTPRoutes targeting the same backend Service:port but with different backendRef filters may apply only one route's filter set to all requests reaching that backend. An attacker can impose their filter context on another route's requests, potentially crossing namespace boundaries.

In vLLM before version 0.24.0, a crafted speculative decoding request can cause the rejection sampler to produce a token outside the model vocabulary. This triggers a GPU device-side assertion crash in the engine worker, aborting all concurrent requests.

In FOSSBilling prior to version 0.8.0, the Guest API invoice/update endpoint lacks an authorization check, allowing an unauthenticated user with knowledge of an invoice hash to modify the payment gateway for an unpaid invoice. An attacker who obtains the hash (e.g., via shared URLs, referrer headers, or email links) can change the `gateway_id` to any configured payment gateway.

Memory corruption occurs when processing asynchronous input parameters due to improper handling of modified values between check and use.

The vulnerability causes memory corruption when processing invalid HT40 channel layouts during dynamic channel switching. This flaw may lead to unexpected system behavior.

The vulnerability is caused by using a static initialization vector (IV) for AES-GCM key wrapping. AES-GCM requires a unique IV for each operation to ensure cryptographic security.

The vulnerability causes memory corruption when allocating memory with sizes exceeding the maximum allowed value. This can lead to unpredictable application behavior.

A vulnerability in the metrics-service retention policy management component of Amazon mcp-gateway-registry before version 1.0.13 allows an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that is interpolated into SQL statements in identifier position.