CVE Vulnerability Catalog

In Pi-hole prior to 6.5, getFTLPID() in utils.sh validates the pihole-owned /run/pihole-FTL.pid file with expr, rejecting only values whose first character is not a digit. An attacker with code execution as pihole can write a digit-prefixed arithmetic expression that Bash then evaluates as root, enabling command substitution execution.

In draw.io Desktop prior to 31.5.2, the Windows application launched powershell and attrib by bare executable name. When draw.io was not already running, opening a diagram from File Explorer made the diagram directory the current working directory, allowing a colocated attacker-controlled powershell.bat or attrib.exe to be resolved first.

In the Ladybird browser prior to commit 209579c, FinalizationRegistry::cleanup() removed a dead record, retained an iterator to the next record, and then invoked attacker-controlled JavaScript through the cleanup callback. If that callback called unregister() for the next record, the retained iterator referenced a freed node, and the next iteration read its fields after free.

In the Ladybird browser prior to commit c0d68bd, CSSStyleSheet.cssRules, insertRule(), and deleteRule() did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read rules and insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy.

In pgAdmin 4 server mode before 9.19, get_complete_file_path() only stripped leading slashes before joining paths, so a path such as ../<another user>/.pgpass could name another user's file. The sslkeylogfile parameter was passed to libpq unchanged, and make_conninfo() quoted parameter values but not names, allowing additional keyword=value pairs to be smuggled in.

In pgAdmin 4 before 9.19, when a server had no password file, client certificate, or client key configured, or the configured file could not be found, pgAdmin omitted the parameter and libpq fell back to the defaults of the operating-system account running pgAdmin. In server mode any user could therefore connect using the service account's saved passwords or client certificate.

In pgAdmin 4 server mode, libpq looks up connection services in the service file of the operating-system account, allowing users to use that account's credentials or certificate files. The vulnerability affects versions before 9.19 and can lead to unauthorized access to database servers.

In pgAdmin 4 server mode, removing KRB5CCNAME caused the Kerberos library to fall back to the service account's default credential cache, allowing any user to connect as the service principal. The vulnerability affects versions before 9.19 and also includes bypassing gssencmode=disable and SSPI behavior on Windows.

In pgAdmin 4 server mode, the user-set binary path was not checked against SHARED_STORAGE directories, allowing an executable to be uploaded and run as the pgAdmin service account. The vulnerability is especially relevant on Windows where files can be executable, and affects versions before 9.19.

In pgAdmin 4 server mode, the sshtunnel library always loaded unencrypted private keys from the service account's ~/.ssh and read its SSH configuration, allowing any user to configure a tunnel using the service account's identity. The vulnerability affects versions before 9.19.

In server mode, pgAdmin 4 keeps an account per authentication source, so the same username can exist as both an internal and an LDAP account. After LDAP or Kerberos authentication, pgAdmin selected the account to log in by username alone, without verifying that it came from the source that authenticated the user, allowing session takeover of another account with its role, servers, and saved database passwords.

In pgAdmin 4 server mode, the internal account lockout after MAX_LOGIN_ATTEMPTS failed logins (3 by default) could be bypassed in several ways. Flaws in Flask-Security views, case-sensitive username lookup, and interaction with other authentication sources (LDAP, webserver, Kerberos) allow an unauthenticated attacker unlimited password guesses against any internal account, including the administrator's. Additionally, unauthorized password resets and server configuration disclosure in the About box are possible.

In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response. The vulnerability allows privilege escalation to administrative level.

In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating only the second factor login step. The vulnerability bypasses the first authentication factor.

The All In One Login WordPress plugin in versions up to 2.4.1 contains an unauthenticated Cross Site Scripting (XSS) vulnerability.

The GS Testimonial Slider WordPress plugin in versions up to 3.3.10 contains a contributor-level PHP Object Injection vulnerability.

The Enable Media Replace WordPress plugin in versions up to 4.2.2 contains a subscriber-level PHP Object Injection vulnerability.

praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path without sanitization, and `path.Join` collapses parent-directory traversal. A remote Telegram user who can message the bot can therefore write outside `uploads/` within the persistent agent workspace mounted at `/workspace/agent`; because `allow_from: []` permits all senders by default, no prior authentication is required in that configuration. The attacker can plant or overwrite `CLAUDE.md`, instruction, skill, hook, or configuration files that the Claude agent reads and operates on across later runs, turning a document upload into stored instruction injection. The demonstrated arbitrary-write scope is the persistent agent workspace volume, not an unrestricted host-filesystem write. This issue is fixed in version 0.9.1.

In PDF Reader MCP versions 2.2.0 through 3.0.0, when the opt-in HTTP transport is enabled, the X-API-Key header is never validated despite startup logs claiming authentication is enabled. As a result, the /mcp endpoint accepts unauthenticated clients, and with the default 0.0.0.0 bind address anyone who can reach the port can invoke PDF tools and read any PDF the server process can open. URL-based sources also allow limited server-side request forgery, with private and loopback destinations blocked by default.

In Hydra (a layer-two scalability solution for Cardano) before 2.1.0, the Claim branch in the deposit validator only checks that datum.head_id matches the attacker-controlled redeemer.currencySymbol and that the transaction is valid before the deposit deadline. It neither requires spending the Head state-token UTxO in the same transaction nor constrains outputs, so after a deposit via POST /commit is confirmed, any third party can consume the pending deposit UTxO and redirect the assets to an arbitrary address.