CVE Vulnerability Catalog

The vulnerability in Metalama's Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. Through a pipe with a predictable name, a same-user local process can send crafted messages leading to arbitrary code execution inside the Visual Studio process. Default Windows pipe ACLs limit writers to the logged-in user, so no privilege escalation or security boundary crossing occurs.

Metalama before versions 2025.1.18, 2026.0.25, and 2026.1.19 loads and executes compile-time assemblies from predictable temporary directories, trusting existing artifacts based on marker files. On Linux and macOS, the temporary directory is world-writable, allowing a local unprivileged user to pre-create the directory structure and plant a malicious DLL. When a privileged developer or build account runs a build, Metalama executes the planted artifact in the compiler, IDE, or MSBuild process.

ag-psd before version 31.0.0 allows readPsd() to allocate image and layer buffers based on declared PSD geometry before validating against available data. A tiny PSD declaring enormous dimensions can force multi-gigabyte memory allocation, leading to memory exhaustion and process termination. Version 31.0.0 adds a composite-image allocation limit, but full coverage of the layer-rectangle allocation path is not confirmed.

Filecoin Pin before version 1.1.0 has flawed fork detection in the GitHub upload action, which only checks event.pull_request. In the two-workflow pattern, workflow_run lacks this event, so isForkPR is false and an artifact from an untrusted fork is uploaded using the repository owner's wallet. An external contributor can cause unauthorized Filecoin wallet expenditure.

NovumOS before version 0.25-beta.1 runs the Nova interpreter in Ring 0 with unrestricted kernel memory access. Loading a malicious .nv script through the shell allows a local user to execute code with kernel privileges without security checks. Script execution is not isolated in Ring 3.

Stack-based buffer overflow and out-of-bounds write in Thales Sentinel Keys Server on Windows. The server does not check the length of the first field in the input message, allowing a local attacker to execute code as NT AUTHORITY\SYSTEM and escalate privileges.

OpenVM before 1.7.0 (and affected 2.0 and 2.1 prereleases) has a vulnerability in OpenVmHalo2Verifier.verify where raw calldata from proofData can invoke another external function instead of the verifier, accepting arbitrary app commitments and public values without proof validation.

OpenVM before 1.7.0 (and affected 2.0 and 2.1 prereleases) has a vulnerability in MemoryMerkleAir that does not forbid Merkle expansion rows at parent_height = 0 or below when expand_direction != 0. A malicious prover can fabricate a subtree and change the committed memory root without a corresponding memory operation, undermining OpenVM proof soundness.

MyTube before 1.10.3 registers static and cloud routes before API routes, leaving them outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access videos, thumbnails, avatars, subtitles, and cloud signed URLs.

In MyTube prior to 1.10.3, the backend does not enforce the visitor role's public-only restriction when login is enabled and a visitor password is configured. The frontend filter is client-side only, and the middleware and video storage layer do not check the caller's role or visibility, so a visitor can enumerate and retrieve hidden videos along with their file paths.

In the OSAC operator (revision 8220502), the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data without sanitizing the resulting rest.Config. An attacker able to create or modify a Secret with the osac.openshift.io/remote-cluster-kubeconfig label can supply an exec credential plugin, causing arbitrary process execution as the console-proxy service account, while an attacker-controlled server address enables SSRF from the proxy pod.

In RAGFlow from 0.25.2 until 0.27.3, the POST /api/v1/agents/chat/completions endpoint invokes completion_openai and returns through the OpenAI-compatible branch before UserCanvasService.accessible() checks access to the agent. An authenticated user who knows another user's private agent UUID can execute that workflow and read its output across the user or tenant boundary.

In Pi-hole from 6.4.2 until 6.5, the root-run updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker running as pihole can replace the path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race them so chmod makes a sensitive target world-readable.

In Pi-hole prior to 6.5, getFTLPID() in utils.sh validates the pihole-owned /run/pihole-FTL.pid file with expr, rejecting only values whose first character is not a digit. An attacker with code execution as pihole can write a digit-prefixed arithmetic expression that Bash then evaluates as root, enabling command substitution execution.

In draw.io Desktop prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name. When draw.io was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved first.

In the Ladybird browser prior to commit 209579c, FinalizationRegistry::cleanup() removed a dead record, retained an iterator to the next record, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, the retained iterator referenced a freed node, and the next iteration read its fields after free.

In the Ladybird browser prior to commit c0d68bd, CSSStyleSheet.cssRules, insertRule(), and deleteRule() did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read rules and insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy.

In pgAdmin 4 server mode before 9.19, get_complete_file_path() only stripped leading slashes before joining paths, so a path such as ../<another user>/.pgpass could name another user's file. The sslkeylogfile parameter was passed to libpq unchanged, and make_conninfo() quoted parameter values but not names, allowing additional keyword=value pairs to be smuggled in.

In pgAdmin 4 before 9.19, when a server had no password file, client certificate, or client key configured, or the configured file could not be found, pgAdmin omitted the parameter and libpq fell back to the defaults of the operating-system account running pgAdmin. In server mode any user could therefore connect using the service account's saved passwords or client certificate.

In pgAdmin 4 server mode, libpq looks up connection services in the service file of the operating-system account, allowing users to use that account's credentials or certificate files. The vulnerability affects versions before 9.19 and can lead to unauthorized access to database servers.