CVE Vulnerability Catalog

In Netopeer2, a low-privileged authenticated NETCONF user can remotely crash netopeer2-server by sending a get RPC with an invalid subtree filter containing format specifiers. In src/log.c the already formatted buffer is passed to np2log() as the format string, causing vsyslog() to interpret attacker-controlled percent sequences. Denial of service was confirmed on version 2.8.7; reliable remote code execution was not confirmed.

In the refitter dotnet tool prior to 2.1.1, NJsonSchema is invoked with unsafe $ref resolution defaults when generating Refit interfaces from attacker-controlled OpenAPI descriptions. Remote http(s) references cause requests from the developer or CI host and inline untrusted content, while absolute local paths and ../ traversal allow arbitrary local-file disclosure. The chain stops at SSRF, remote file inclusion, and local file inclusion, not code execution.

In LightSAML prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. XMLSecurityDSig::validateReference() removes the enveloped signature from the shared DOM, but processRefNode() resolves Reference URI="#id" document-wide via XPath //*[@Id] and takes item(0), which need not be the assertion whose claims LightSAML consumes. An attacker with a captured genuinely signed assertion can place its signature-stripped bytes in samlp:Extensions and present a forged assertion with the same ID and copied signature, enabling authentication bypass or privilege escalation.

In Kubewarden policies before version 2.1.2, the trusted-repos-policy compares an image's registry hostname against reject and allow lists case-sensitively even though registry DNS names are case-insensitive. An image with an uppercase or mixed-case registry hostname can miss a rejection rule for the equivalent lowercase host, so the admission policy accepts a resource whose container runtime pulls the same prohibited image.

In ActivityPub for Ghost from 1.0.0 until 1.2.6, the Undo handler allows a remote federated server to cause the service to act on a follow or repost as though the activity came from a different account. This permits removal of an existing follow relationship or repost belonging to another account without that account's involvement.

The standalone Element Call SPA (from 0.16.0 until 0.20.3) logs the `password` URL query parameter. When a user submits an error report (rageshake), these logs are shared with the application operator, potentially disclosing the shared password used to encrypt the call.

In LubeLogger prior to 1.6.8, `PrintRecordStickers` verifies access to the supplied `vehicleId` but fetches caller-supplied `recordIds` without checking that each record belongs to the authorized vehicle. An authenticated user can thus retrieve other users' records across multiple modules.

In unpatched uhttpd repository snapshots, `client_parse_header()` compares the `Transfer-Encoding` value to `chunked` case-sensitively, although transfer-coding tokens are case-insensitive. A mixed-case token is accepted without enabling chunked handling, allowing HTTP request smuggling on keep-alive connections.

In unpatched uhttpd repository snapshots, `uh_ubus_data_send()` can desynchronize HTTP request boundaries when a `POST /ubus` JSON body arrives in multiple TCP segments. The unread body suffix is then processed as a new request on the same keep-alive connection.

uhttpd is a small HTTP server. In unpatched repository snapshots, client_poll_post_data() in client.c consumes an invalid chunk-length line (e.g., a size exceeding INT_MAX), then clears r->content_length and r->transfer_chunked without draining the remaining body or setting request.connection_close. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization.

In LORIS versions from 22.0.0 before 27.0.4 and from 28.0.0 before 28.0.2, the `imaging_browser` module API permits edits to imaging data without checking the frontend edit permissions. An authenticated API caller can modify imaging data without the required edit authorization.

In LORIS versions from 16.0.0 before 27.0.4 and from 28.0.0 before 28.0.2, the `issue_tracker` backend does not correctly verify edit access permissions, although the frontend restricts which issues a user may edit. An authenticated user can submit backend changes to issues outside their permitted edit scope.

fickling through 0.1.12 incorrectly treats calls to functions from Python standard library modules as safe without inspecting their actual behavior. As a result, check_safety() returns LIKELY_SAFE for malicious pickle payloads that reach code execution or file writes through such callables (e.g., dataclasses._create_fn, mailcap.findmatch, readline.write_history_file). Because fickling.load() uses this verdict as a security gate before pickle.loads(), the payload is deserialized and executed with the privileges of the victim process.

A vulnerability in Trail of Bits fickling through 0.1.12 allows a pickle STACK_GLOBAL operand with a dotted __qualname__ (e.g., "Values.read_file") to be resolved by pickle's find_class via _getattribute to an arbitrary attribute path instead of a module-level function. Fickling records only the leading component in its import tracking and renders the operation as a plain import, so the trailing attribute reference is never analyzed as a call; the OvertlyBadEvals pass does not flag it and check_safety() returns LIKELY_SAFE with zero findings. This lets an attacker reach a class method that performs code execution (optparse.Values.read_file executes exec(open(filename).read(), vars)), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate.

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields (billing and shipping address values and the customer order note) before outputting them in generated invoice and packing-slip documents. This allows unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.

Shopper is a headless e-commerce admin panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users. The flaw exposes account profile data and permits user-ID enumeration; combined with delete_customers, it can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

A stored XSS vulnerability in the Shopper admin panel allows an authenticated staff member with content-upload permissions to store executable HTML or SVG files that are served without Content-Disposition or CSP headers. When an administrator opens such a file, the malicious script executes in their session and can create a new attacker-controlled administrator account with a chosen password. The issue affects versions 2.0.0 through 2.10.0 and 3.0.0-beta.1/beta.2, and is fixed in 2.10.1 and 3.0.0-beta.3.

In Shopper before 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with edit_products can obtain the signed component state and permanently delete individual or multiple variants without the delete_product_variants permission. This can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. The issue is fixed in version 2.10.0.

In jack before 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses, and lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation failures. The public extras field in lib/errors/FetchError.ts remains enumerable and is emitted by JSON serialization, exposing internal Radarr/Sonarr X-Api-Key and connector headers such as CF-Access-Client-Secret. The GET /peer/items/:id, GET /servers/health, and GET /torznab/download/:id endpoints can expose these secrets. The issue is fixed in version 0.1.0.

In Dream Displays from 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to yt-dlp under specific conditions. Unintended command-line options may be interpreted by yt-dlp, potentially altering its behavior. The issue is fixed in version 1.8.2.