CVE Vulnerability Catalog

Shopper is a headless e-commerce admin panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users. The flaw exposes account profile data and permits user-ID enumeration; combined with delete_customers, it can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

A stored XSS vulnerability in the Shopper admin panel allows an authenticated staff member with content-upload permissions to store executable HTML or SVG files that are served without Content-Disposition or CSP headers. When an administrator opens such a file, the malicious script executes in their session and can create a new attacker-controlled administrator account with a chosen password. The issue affects versions 2.0.0 through 2.10.0 and 3.0.0-beta.1/beta.2, and is fixed in 2.10.1 and 3.0.0-beta.3.

In Shopper before 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with edit_products can obtain the signed component state and permanently delete individual or multiple variants without the delete_product_variants permission. This can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. The issue is fixed in version 2.10.0.

In jack before 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses, and lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation failures. The public extras field in lib/errors/FetchError.ts remains enumerable and is emitted by JSON serialization, exposing internal Radarr/Sonarr X-Api-Key and connector headers such as CF-Access-Client-Secret. The GET /peer/items/:id, GET /servers/health, and GET /torznab/download/:id endpoints can expose these secrets. The issue is fixed in version 0.1.0.

In Dream Displays from 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to yt-dlp under specific conditions. Unintended command-line options may be interpreted by yt-dlp, potentially altering its behavior. The issue is fixed in version 1.8.2.

In ZTNET before 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, via POST /api/auth/user/invalidateUser. The handler checks only that a session exists and does not compare session.user.id with the client-supplied userId, so supplying the victim's userId and a non-matching deviceId sets the target account's isActive to false and login is refused. The issue is fixed in version 0.8.0.

ESPAsyncWebServer before version 3.11.2 has a flaw in the multipart parser where it frees a buffer and sets it to NULL but still writes through the NULL pointer. This occurs when the byte after a file part boundary is not a valid terminator, causing a StoreProhibited exception and device reboot. The vulnerability requires a route with file upload or OTA handling.

SABnzbd before version 5.1.0Beta3 allows an attacker with a valid API key to invoke orphan job deletion with a path parameter that is not confined to the download directory. An absolute path can cause recursive deletion of files or directories writable by the SABnzbd process. The API key is stored in plaintext in the configuration file.

libriscv before version 1.18 allows a crafted ELF binary to cause out-of-bounds reads in the host emulator. The serialize_execute_segment and lookup functions trust section offsets and sizes without verifying them against the file size, potentially leading to SIGSEGV or host memory disclosure. The vulnerability is fixed in version 1.18.

Ring before version 1.15.5 has a vulnerability in the wrap-nested-params middleware, which uses a backtracking regular expression to match parameter names. An attacker can craft a parameter name that causes quadratic CPU consumption (O(n^2)), leading to denial of service. Ring-Defaults users are also exposed because the middleware is enabled by default.

MoLing in SSE mode (started with -l) does not authenticate requests to the /sse and /message endpoints, and the mcp-go dependency sets Access-Control-Allow-Origin: *. A malicious web page can open a cross-origin EventSource to /sse, read the sessionId, and send unauthorized MCP tool calls via /message, potentially leading to file read/write or command execution. The issue is fixed in version 0.5.0.

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy: AuthController.login() throws BadCredentialsException immediately for an unknown username, before passwordEncoder.matches(...), whereas an existing username with an incorrect password incurs the bcrypt comparison cost. Both cases return the same generic HTTP 401 response, but repeated latency measurements disclose valid usernames without credentials. This issue is fixed in release 1.0.8.

In ThingLinks before 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed compilation and loading flow. An authenticated attacker can supply code that is compiled and executed on the server, leading to remote server-side code execution. The issue affects the rule engine's Groovy script test/register flow and is fixed in version 1.4.0.

In ThingLinks before 1.4.0, an unauthenticated SQL injection vulnerability exists in the TDengine TDS APIs. JSON field values submitted to /anyUser/tds/insertTableData reach unsafe SQL construction in the TDS mapper, allowing a remote unauthenticated attacker to tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The issue is fixed in version 1.4.0.

The vulnerability in Metalama's Windows Visual Studio integration deserializes local named-pipe messages without restricting which CLR types can be instantiated. Through a pipe with a predictable name, a same-user local process can send crafted messages leading to arbitrary code execution inside the Visual Studio process. Default Windows pipe ACLs limit writers to the logged-in user, so no privilege escalation or security boundary crossing occurs.

Metalama before versions 2025.1.18, 2026.0.25, and 2026.1.19 loads and executes compile-time assemblies from predictable temporary directories, trusting existing artifacts based on marker files. On Linux and macOS, the temporary directory is world-writable, allowing a local unprivileged user to pre-create the directory structure and plant a malicious DLL. When a privileged developer or build account runs a build, Metalama executes the planted artifact in the compiler, IDE, or MSBuild process.

Filecoin Pin up to and including version 1.1.0 does not enforce request rate limits or per-user quotas on POST /pins, and each pin is processed in the background without a queue or concurrency cap. Missing byte, block and traversal-time limits allow an authenticated caller, or an anonymous caller when ALLOW_NO_AUTH=true, to exhaust disk, network, CPU, memory and libp2p resources, causing service degradation or host/process failure and leaving partial CAR files requiring recovery.

ag-psd before version 31.0.0 allows readPsd() to allocate image and layer buffers based on declared PSD geometry before validating against available data. A tiny PSD declaring enormous dimensions can force multi-gigabyte memory allocation, leading to memory exhaustion and process termination. Version 31.0.0 adds a composite-image allocation limit, but full coverage of the layer-rectangle allocation path is not confirmed.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in decode_R13_R2000 in src/decode.c. The class-decoding loop performs realloc on every iteration without a sanity check on num_classes; manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.

LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make decode_preR13_entities() in src/decode.c enter a nonterminating loop that allocates a new object each iteration. decode_preR13 in src/decode_r11.c computes size from the raw file-controlled entities_start and entities_end header bounds; the callee clamps end to dat->size but never recalculates size. At end of input, bit_read_RC and bit_read_RS stop advancing dat->byte, the overflow guard fails, and the no-advance check compares against oldpos saved before the loop. This leaves repeated allocation of dwg->object entries until allocation fails or the process is OOM-killed. The defect is fixed in version 0.14.8413.