CVE Vulnerability Catalog

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when decoding planar pixel data. An attacker can supply a crafted PICT file with manipulated dimensions, causing heap over-reads leading to crashes or heap memory disclosure.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user.

Scribus before 1.6.7 and 1.7.x before 1.7.4 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user.

A deserialization of untrusted data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. The vulnerability was patched on 11 September 2026.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS. This issue affects Blocksy Companion: from n/a through 2.1.60.

In SOCFortress CoPilot prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints omit role and tenant authorization, and the exclusion creation endpoint does not properly validate credentials — any invalid, expired or forged Bearer token can create a suppression rule. Additionally, rules with a null customer_code apply across all tenants, and low-privilege users can list, modify, disable or delete exclusions.

In SOCFortress CoPilot prior to 0.1.77, the POST /api/scoutsuite/generate-gcp-report endpoint passes the raw multipart filename to the file writer without sanitization or a resolved-path containment check. A traversal filename therefore writes the supplied JSON outside the intended report directory, including into the application source directory.

In the ng-antd-admin template prior to 22.0, a hardcoded default JWT secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker can bypass authentication and authorization and impersonate any user, including administrators.

In SOCFortress CoPilot, the unauthenticated /scoutsuite-report StaticFiles mount exposes the scoutsuite-report directory, disclosing HTML reports and result files containing AWS, Azure and GCP IAM principals, resource inventories and misconfigurations. During a GCP scan, the service-account key is saved into that same web-served directory and removed only after the scan finishes, so an anonymous client can retrieve it.

In SOCFortress CoPilot prior to 0.1.76, verify_graylog_header and verify_velociraptor_header authenticate webhooks against the same publicly hardcoded fallback header, also shipped in .env.example. Deployments with unchanged secrets let an anonymous caller bypass JWT authentication, invoke active-response actions and create forged alerts.

In SOCFortress CoPilot, portal users including customer_user accounts can submit stored markup via the alert comment endpoint, which is rendered without sanitization using v-html. This enables stored XSS, and because access and refresh tokens are persisted in JavaScript-readable storage, injected script can steal them and impersonate the viewer. The same unsanitized rendering affects other SOC fields (cases, assets, health-checks), with fixes first contained in versions 0.1.70 (health-check) and 0.1.76 (comments and other SOC sinks).

In SOCFortress CoPilot prior to 0.1.76, the POST /api/agent_data_store/upload endpoint allows customer_user callers to choose bucket_name and object_name without an allowlist, tenant prefix, or ownership check. This enables overwriting objects belonging to any tenant, including sysmon configs, report templates, and case evidence. The issue is fixed in version 0.1.76.

In libass prior to 0.17.5, wrap_lines_measure can overread and overwrite the glyph array while rendering malicious ASS content. In certain wrap modes, a line ending with a literal backslash-n sequence can cause the measurement loops to overshoot by one glyph, leading to an uninitialized read and an out-of-bounds write. The issue is fixed in version 0.17.5.

In libass from 0.17.4 until 0.17.5, event pruning does not guard against negative Matroska ReadOrder values, allowing an attacker to clear bits at attacker-controlled positions near the NULL pointer. Exploitation requires a malicious Matroska stream, enabled read-order checking, and later pruning of malicious events. The issue is fixed in version 0.17.5.

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, the host_session_id query/form parameter is substituted into the cool.html editor page without HTML encoding, unlike parameters passed through the existing variable-encoding mechanism. An attacker who induces a victim to load a crafted URL can inject HTML and, in the absence of an effective Content Security Policy, execute scripts in the Collabora Online iframe's origin, exposing the session authentication token and page contents. A reverse proxy that preserves the Content Security Policy header sent by coolwsd mitigates the script-execution scenario. This issue is fixed in versions 24.04.18 and 25.04.11.

Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, several document operations delegated to LibreOfficeKit in the per-document kit process fail to enforce a session's read-only state. A read-only user, such as a viewer-role WOPI user, can send crafted WebSocket messages to execute document-mutating UNO commands and dialog operations despite the read-only interface. The changes can mislead co-viewers within the live session, or an authorized editor sharing the session can unknowingly save the modifications. The read-only attacker cannot save the document directly, and changes are discarded when the kit session ends unless an authorized editor saves them. This issue is fixed in versions 24.04.18 and 25.04.11.

In Chamilo LMS prior to 2.0.1, career.lib.php and import_csv.php call PHP's native unserialize() on user_career.extra_data from the database without the allowed_classes: false option. An attacker able to write crafted serialized PHP objects can trigger POP gadget chains in Symfony, Doctrine, or Monolog components, leading to arbitrary OS command execution. The issue is fixed in version 2.0.1.

In Chamilo LMS from 2.0.0 until 2.0.1, GET /user/{username} is anonymously reachable and renders six user-editable profile fields inside {% autoescape false %} without server-side sanitization. A ROLE_STUDENT attacker can plant HTML in their profile that executes in the browser of any visitor, including administrators. The issue is fixed in version 2.0.1.

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, the add, delete_gradebook_from_skill, save_profile, and delete_profile actions in public/main/inc/ajax/skill.ajax.php perform database mutations without Security::check_token() validation. An attacker can use cross-site request forgery to cause an authenticated administrator or DRH who visits a malicious page to create, modify, or delete skill records and profiles, or remove skill-gradebook associations. This issue is fixed in version 2.0.1.