CVE Vulnerability Catalog

A vulnerability in Lightpanda before version 0.3.1 allows bypassing the Same-Origin Policy by incorrectly parsing the @ character in URLs. An attacker can craft a URL like http://attacker.com/@victim.com/, which is fetched from attacker.com but treated as originating from victim.com.

A vulnerability in Metabase allows a user with permission to add or edit database connections to achieve remote code execution on the Metabase server. It exploits a flaw in the Snowflake JDBC driver that can write arbitrary files anywhere on the host, including replacing Metabase's own database driver files that later execute inside the Metabase process.

A vulnerability in Penpot prior to 2.14.5 allowed account takeover by exploiting invitation tokens, embedding a profile ID, and issuing a session based on email match without password verification.

In LightRAG prior to 1.5.4, when LIGHTRAG_API_KEY is set but AUTH_ACCOUNTS is unset, X-API-Key protection can be bypassed. The system falls back to a hardcoded DEFAULT_TOKEN_SECRET, and /auth-status and /login can mint guest JWTs that are accepted before checking the API key. A remote unauthenticated attacker can call guarded endpoints, including document read, upload, deletion, graph mutation, and query endpoints.

LightRAG before version 1.5.4 defaults to CORS_ORIGINS=* combined with allow_credentials=True, causing Starlette CORSMiddleware to whitelist every origin for credentialed cross-origin requests. An attacker can make authenticated API requests from a malicious website, exfiltrating documents and knowledge graph data or performing destructive actions.

A path traversal (Tar Slip) vulnerability in Cornac before version 2.6.0 allows an attacker to write arbitrary files outside the intended cache directory by supplying a crafted TAR archive containing ../ sequences, absolute paths, or symlink/hardlink entries to the _extract_archive() function in cornac/utils/download.py. Attackers can trigger this vulnerability through the built-in dataset loaders, which automatically download and extract archives, causing archive.extractall() to write files to arbitrary locations on the filesystem accessible to the running process.

The Grav API plugin (grav-plugin-api) before version 1.0.4 does not validate the origin of the admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks the URL scheme (http/https) and never verifies the host against the server's own origin, allowing an attacker to supply an arbitrary host. An unauthenticated attacker can cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server; when the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover.

An improper validation of integrity check value and improper certificate validation in certain ASUS router models allows a remote man-in-the-middle (MITM) attacker to force the router to download and execute arbitrary commands from a spoofed server.

An authentication bypass vulnerability in Ciena Navigator NCS, MCP, and Blue Planet products due to improper handling of HTTP request paths and headers. An unauthenticated attacker can manipulate requests to bypass authentication and audit logging.

In Ciena's Navigator Network Control Suite (NCS) and Manage Control Plan (MCP), hidden system accounts with default, predictable passwords were discovered. These accounts have very limited permissions but could be used by an attacker in combination with other weaknesses to escalate privileges on the system.

A buffer overflow vulnerability has been discovered in the OpenHTJ2K library version 0.18.4 and earlier. An attacker can exploit this flaw in the invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded functions in decoder.cpp, allowing arbitrary code execution.

A heap-based out-of-bounds write vulnerability exists in OpenHTJ2K versions 0.18.3 and earlier. The issue occurs in j2k_precinct_subband::parse_packet_header() due to missing bounds validation before writing coding-pass lengths to the j2k_codeblock::pass_length[128] array.

A vulnerability in the Twig template library for PHP allows sandbox bypass for Stringable objects when used with Traversable values in join and replace filters or in and not in operators. Prior to version 3.27.0, the sandbox __toString() checks did not fully cover these cases, enabling coercion to strings without sandbox policy enforcement.

A vulnerability in the Twig template library for PHP before version 3.27.0 allows bypassing the SandboxExtension::ensureToStringAllowed() check when coercing dynamic mapping keys to strings. An attacker can exploit a Stringable object used as an array key to invoke its __toString() method without proper sandbox validation.

A vulnerability in Twig before version 3.27.0 allows bypassing sandbox restrictions through deprecated internal wrappers in src/Resources/core.php. Functions like twig_array_some(), twig_array_every(), and twig_check_arrow_in_sandbox() do not forward the current sandbox state to CoreExtension methods, enabling unauthorized callable execution.

An Improper Input Validation vulnerability in Illustrator could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, specifically opening a malicious file. The scope is changed, potentially allowing an attacker to gain elevated access or control over the victim's account or session.

A vulnerability in the Twig template library for PHP (versions 3.9.0 through 3.26.0) allows bypassing the SourcePolicyInterface sandbox security policy when rendering templates via the template_from_string() function. The inner template is compiled under a synthetic name that can fall outside the sandbox decision, enabling an attacker to execute code without security policy enforcement.

In Twig, Compiler::string() does not escape single quotes when a template name from a {% use %} tag is placed inside a PHP single-quoted string literal. A crafted template name can terminate the string and inject arbitrary PHP expressions into the compiled cache file.

The ruby-jwt library before versions 2.10.3 and 3.2.0 contains a vulnerability that accepts forged JWT tokens. The issue occurs when an empty key is used for verification, allowing an attacker to bypass authentication.

A vulnerability in Aetopia Digital Asset Management DAM version 1.0.0 allows a remote attacker to execute arbitrary code via the name and description parameters of the Add/Update Project function.