CVE Vulnerability Catalog

HashiCorp Terraform Enterprise had an issue in its VCS ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This allowed an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process.

In Devolutions Server 2026.2.9.0, improper enforcement of a mandatory multi-factor authentication (MFA) policy was found. An attacker with valid user credentials can bypass the MFA Required policy and authenticate without completing multi-factor authentication. The issue occurs when DVLS encounters an invalid default MFA value.

In Pillow before version 12.3.0, the GdImageFile._open() method in GdImageFile.py read image dimensions from the GD 2.x header without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded.

In Pillow before version 12.3.0, the bdf_char() function in BdfFontFile.py reads the BBX width and height from a BDF font file and passes attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing decompression bomb protection and allowing excessive memory allocation.

In Pillow before version 12.3.0, FontFile.compile() does not call Image._decompression_bomb_check(), allowing a font to trigger excessive memory allocation during conversion or saving.

In Pillow before version 12.3.0, the _load_bitmaps() function in PcfFontFile.py reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation.

Certain HP DeskJet All-in-One printers may be vulnerable to information disclosure, allowing an unauthenticated attacker to access sensitive information through exposed APIs.

In Apache OpenNLP, the libsvm document categorization module (3.x line) is vulnerable to untrusted Java deserialization. The SvmDoccatModel.deserialize(InputStream) method uses java.io.ObjectInputStream without a filter, allowing an attacker to execute arbitrary code via a crafted stream.

A vulnerability in BeyondTrust Remote Support and Privileged Remote Access allows an unauthenticated remote attacker to trigger a denial-of-service (DoS) condition due to insufficient validation of client-supplied input in the network communication subsystem.

A critical pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

In DrawIO for ownCloud prior to version 1.0.2 (corresponding to ownCloud 10 prior to 10.15.3), a stored XSS vulnerability was found. Attackers with access to the DrawIO app can inject malicious code due to improper input neutralization during page generation.

In the pnpm package manager prior to versions 10.34.4 and 11.7.0, a crafted lockfile alias could be placed directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout.

pnpm before versions 10.34.4 and 11.8.0 accepts package names from the configDependencies section of pnpm-lock.yaml and uses them directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can supply a crafted lock file containing a traversal-shaped config dependency name, leading to symlink creation outside the intended directory.

In pnpm prior to versions 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory, allowing arbitrary file deletion via the pnpm patch-remove command.

In ownCloud 10 prior to version 10.15.3, a path traversal vulnerability allows an attacker with administrative privileges to execute arbitrary code. The issue is fixed in version 10.15.3.

In SharePoint for ownCloud prior to version 0.4.1 (corresponding to ownCloud 10 before 10.15.3), an SSRF vulnerability allows an attacker with administrative privileges to execute arbitrary code on the system.

An off-by-one error was found in GIMP's PNM file format parser in the pnmscanner_gettoken() function. When parsing a crafted PNM file, a null terminator is written one byte past the end of a stack buffer, leading to memory corruption.

A memory leak vulnerability in OpenVPN versions 2.5.0–2.5.11, 2.6.0–2.6.20, and 2.7_alpha1–2.7.4 allows a remote attacker with a valid tls-crypt-v2 client key to cause a denial of service (DoS).

A vulnerability in Imager::File::JPEG for Perl before version 1.003 causes heap memory leak when reading JPEG files with multiple APP13 markers. The i_readjpeg_wiol function allocates a new buffer for each marker but does not free the previous one, leading to accumulated leaks.

In the Imager library for Perl before version 1.032, there is a heap out-of-bounds read vulnerability in the Imager::File::SGI module. The issue is in the read_rgb_16_rle function, which incorrectly checks the pixel count in an RLE run, leading to a read past the buffer. An attacker can exploit this by providing a crafted SGI image, potentially causing a process crash.