CVE Vulnerability Catalog

ciguard is a static security auditor for CI/CD pipelines. From 0.1.0 to 0.8.1, the published ghcr.io/jo-jo98/ciguard container image inherits the default root user because the Dockerfile lacks a USER directive. This vulnerability is fixed in 0.8.2.

An uncontrolled recursion vulnerability exists in the UFS/UFS2 filesystem image parser in NanaZip from 5.0.1252.0 to before 6.0.1698.0. The GetAllPaths function recurses into subdirectories without a depth limit, causing stack exhaustion and a crash when opening a crafted image.

A denial-of-service vulnerability exists in the littlefs filesystem image parser in NanaZip from 5.0.1252.0 to before 6.0.1698.0. The Open method reads BlockCount from the attacker-controlled superblock without validation, causing billions of heap allocations and memory exhaustion.

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an integer divide-by-zero exists in the UFS/UFS2 filesystem image parser. The vulnerability is triggered when opening a crafted UFS image where the superblock field fs_ipg (inodes per cylinder group) is set to zero; the parser uses this attacker-controlled value as a divisor without validation, causing an immediate hardware trap and process crash. This vulnerability is fixed in 6.0.1698.0.

A null-pointer dereference exists in the UFS/UFS2 filesystem image parser in NanaZip from 5.0.1252.0 to before 6.0.1698.0. When the root inode is a symlink instead of a directory, the parser causes a null-pointer dereference.

NanaZip is an open source file archive. From 5.0.1252.0 to before 6.0.1698.0, an uncontrolled recursion vulnerability exists in the Electron Archive (ASAR) parser. When opening a crafted .asar file with deeply nested JSON in the header, both nlohmann::json::parse and the handler's GetAllPaths function recurse without depth limits, exhausting the thread stack and crashing the NanaZip process. This vulnerability is fixed in 6.0.1698.0.

Adobe Commerce is affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A high-privileged attacker can gain unauthorized write access, requiring user interaction such as visiting a malicious URL.

A use of hard-coded cryptographic key vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.2 and FortiClientWindows 7.2 all versions may allow an attacker to disclose information.

Apache Tomcat has an observable timing discrepancy vulnerability when comparing the AJP secret. The flaw affects versions 11.0.0-M1 through 11.0.21, 10.1.0-M1 through 10.1.54, 9.0.0.M1 through 9.0.117, 8.5.0 through 8.5.100, and 7.0.0 through 7.0.109.

In Dovecot, an attacker can use the IMAP SETACL command to inject the 'anyone' permission into a user's dovecot-acl file even when imap_acl_allow_anyone=no. This causes folders to be spammed to all users. The impact is limited to folder spamming; no unexpected access is gained.

Aplikacja nie wprowadza wystarczających ograniczeń dotyczących uprawnień dostępu do katalogów, co stwarza ryzyko, że inne złośliwe aplikacje mogą uzyskać dostęp do wrażliwych informacji.

The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path traversal vulnerability. When the product is configured with automatic folder creation enabled and a user tries to extract an archive file with a crafted file name, the archived files may be extracted to an unexpected folder.

An SQL injection vulnerability exists in the @sap/hdi-deploy package, where SQL queries are dynamically constructed from user input without proper parameterization or prepared statements. Successful exploitation could allow high-privileged users to alter SELECT statements, impacting confidentiality and availability of the application; there is no impact on integrity.

Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.

Geyser before version 2.9.3 contains a server-side request forgery (SSRF) vulnerability in handling Bedrock player head texture data. By supplying a crafted Base64-encoded skin texture URL via the /give command, an attacker can cause the Minecraft server to issue arbitrary HTTP GET requests to attacker-controlled or internal endpoints.

An issue with app access to camera metadata was addressed with improved logic. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, visionOS 26.5. An app may be able to capture a user's screen.

A permissions checking flaw in macOS Tahoe 26.4. A malicious app may be able to access arbitrary files.

Microdot, a minimalistic Python web framework, in versions prior to 2.6.1 does not sanitize string arguments of the Response.set_cookie() method, particularly not detecting the \r\n sequence. This can be a source of header injection attacks. For an attack to be possible, the attacker must first infiltrate the client (e.g., via an independent XSS attack) to send malicious information destined to be stored in a cookie by the server on behalf of the victim.

The cowlib Erlang library's cow_cookie:cookie/1 function builds a Cookie header without validating cookie names or values. This allows injection of ;, comma, CR, LF, or TAB characters, enabling cookie smuggling and HTTP request splitting. Affects versions from 2.9.0 before 2.21.0.

A vulnerability in the Wikimedia Foundation Echo extension exposes sensitive information to an unauthorized actor. The issue is associated with the file includes/Api/ApiEchoNotifications.Php and affects Echo versions before 1.43.7, 1.44.4, and 1.45.2.