CVE Vulnerability Catalog

OpenEXR versions 3.4.0 through 3.4.9 contain a signed 32-bit integer overflow in the ht_undo_impl() function of the HTJ2K decompression path. A crafted EXR file with 16,385 FLOAT channels at the HTJ2K maximum width of 32,767 overflows the bpl accumulator beyond INT_MAX, causing undefined behavior and potentially a heap out-of-bounds write on allocator-permissive hosts.

In nbconvert versions 6.5 through 7.17.0, when HTMLExporter.embed_images=True, the markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. Version 7.17.1 contains a fix.

nbconvert versions 6.5 through 7.17.0 allow arbitrary file writes outside the intended output directory when processing notebooks containing crafted cell attachment filenames. ExtractAttachmentsPreprocessor passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks with complete control over the destination path and file extension. Version 7.17.1 contains a patch.

Prior to version 4.5.4, Glances' Cassandra export module interpolates keyspace, table, and replication_factor configuration values directly into CQL statements without validation. A user with write access to glances.conf can redirect all monitoring data to an attacker-controlled Cassandra keyspace.

Glances prior to version 4.5.4 exposes a REST API (/api/4/*) accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (Access-Control-Allow-Origin: *). A malicious website can read sensitive system information from a running Glances instance in the victim's browser, leading to cross-origin data exfiltration.

In Dify prior to 1.13.1, the DELETE /console/api/installed-apps/<appId>/conversations/<conversationId> method has poor authorization checking, allowing any Dify-authenticated user to delete another user's chat history. Version 1.13.1 patches the issue.

HKUDS OpenHarness prior to PR #159 remediation contains a session key derivation vulnerability that allows authenticated participants in shared chats or threads to hijack other users' sessions. This stems from a shared ohmo session key lacking sender identity verification, enabling reuse of another user's conversation state and interruption of their active tasks.

A vulnerability in StorageGRID (formerly StorageGRID Webscale) versions prior to 11.9.0.13 and 12.0.0.6 allows an authenticated attacker with low privileges to run arbitrary metrics queries, revealing metric results they do not have access to.

Potential out-of-bounds read in wolfSSHd on Windows when handling a terminal resize request. An authenticated user could trigger the out-of-bounds read after establishing a connection, leaking adjacent stack memory to the pseudo-console output.

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the ticket subject field. An authenticated staff member can inject malicious JavaScript via the editsubject POST parameter, bypassing the incomplete SanitizeForXSS() method, and the script executes in the browsers of other staff members or administrators.

GFI HelpDesk before 4.99.10 contains a stored XSS vulnerability in the Reports module where the title parameter is passed directly to SWIFT_Report::Create() without HTML sanitization. Attackers can inject arbitrary JavaScript into the report title, which executes when staff click the affected report link in Manage Reports.

GFI HelpDesk before 4.99.9 contains a stored XSS vulnerability in the Troubleshooter module where the subject POST parameter is not sanitized in Controller_Step.InsertSubmit() and EditSubmit() before rendering by View_Step.RenderViewSteps(). An authenticated staff member can inject arbitrary JavaScript into the step subject, which executes when any user clicks the affected step link in Troubleshooter > View Troubleshooter.

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the language management functionality. The charset POST parameter is passed without HTML sanitization to SWIFT_Language::Create() and rendered unsanitized by View_Language.RenderGrid(), allowing an authenticated administrator to inject arbitrary JavaScript.

GFI HelpDesk before 4.99.9 contains a stored cross-site scripting vulnerability in the template group creation and editing functionality. An authenticated administrator can inject arbitrary JavaScript via the companyname POST parameter without HTML sanitization, and the script executes in the browsers of administrators viewing the Templates > Groups page.

In Magento Long Term Support (LTS) prior to version 20.17.0, the shared wishlist add-to-cart endpoint authorizes access with a public sharing_code but loads the acted-on wishlist item by a separate global wishlist_item_id and never verifies that the item belongs to the shared wishlist referenced by that code. This lets an attacker import a victim's item into their own cart, copying the victim's private custom-option data, and if a file custom option is used, it can be elevated to cross-user file disclosure.

Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability. A high privileged attacker with local access could exploit it to elevate privileges to perform an unauthorized delete operation.

python-dotenv versions prior to 1.2.2 have `set_key()` and `unset_key()` functions that follow symbolic links when rewriting `.env` files. A local attacker can overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v1.2.2 or apply the patch manually.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.6, LTS2025 8.3.1.0 through 8.3.1.20, and LTS2024 7.13.1.0 through 7.13.1.60 contain a stack-based buffer overflow vulnerability. A high-privileged attacker with local access could exploit it to execute arbitrary commands with root privileges.

Dell PowerProtect Data Domain versions 8.5 through 8.6 contain an OS command injection vulnerability due to improper neutralization of special elements. A high-privileged attacker with remote access could exploit it to execute arbitrary commands with root privileges.