CVE Vulnerability Catalog

A vulnerability in the hex library allows an untrusted package mirror to exhaust the memory or disk space of the machine running mix deps.get, mix deps.update, mix hex.package fetch or mix hex.docs fetch. The issue stems from missing size limits on HTTP responses, gzip decompression, and tarball extraction before checksum verification.

Vulnerability in Hex allows a malicious package publisher or hostile repository server to inject terminal control sequences into Mix task output. Hex prints data from the repository and documentation search service without neutralizing control characters.

In Quay, an authenticated attacker can access auto-prune configurations of repositories from other namespaces, leading to unauthorized information disclosure. The issue is due to improper enforcement of namespace scoping when retrieving policy details.

Vulnerability in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N affects an unknown functionality of the Display QR Code Rendering component. Manipulation of the alignment argument results in improper restriction of rendered UI layers. Attack only possible from local network.

Vulnerability in Netis WF2409E 3.3.42541 affects an unknown function of the Wireless Settings component. Manipulation of the SSID argument results in cross site scripting (XSS). Attack can be performed remotely.

In Thelia v2.6.0, both the admin login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate admin accounts. Lack of rate limiting facilitates scalable attacks.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing bypass of configured policy restrictions. Local attacker can create a symlink to a policy-restricted path.

A vulnerability has been found in idcCMS 1.70. It affects an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. It affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation is possible. The exploit is publicly available and might be used. The vendor was contacted but did not respond.

A vulnerability in Eleveo Call Recording Software up to 10.3.0 affects unknown code in the /auth/realms/default/protocol/openid-connect/logout file of the JWT Token Handler component. Manipulating the id_token_hint argument can lead to the use of the GET request method with sensitive query strings. The attack can be launched remotely but is difficult to exploit.

A vulnerability in y_project RuoYi up to 4.8.3 affects the renderDrawer function in the /system/dict/data/add file of the Dictionary Data Drawer Preview component. Manipulating the cssClass argument can lead to cross-site scripting. The attack can be performed remotely, and the exploit has been publicly disclosed.

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.

Incorrect default permission in Samsung Flow before version 4.9.22.4 allows local attackers to launch an arbitrary activity with Samsung Flow privileges on the connected device.

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition.

In the Zephyr zbus subsystem, the proxy agent IPC backend (subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c) logged the channel name of a rejected inter-domain frame using a plain %s conversion without ensuring NUL termination. The struct zbus_proxy_msg frame carries a fixed-size channel_name[] array as its last member, and the only code verifying termination rejects exactly such frames — so the warning printed a non-terminated buffer precisely on the error paths. Any peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it.

Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that exposes the configured api_key because the router's Args struct lacks a redact attribute for it. Attackers with access to router logs, container output, or OTLP telemetry can recover the Bearer token and call the protected embedding and rerank endpoints.

phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups.

GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group.

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query.

Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the citation-checker extra because the public_url guard validates a resolved address but fetch re-resolves the hostname at connect time. Attackers who plant a crafted reference URL in a checked document and control its DNS can rebind it to internal addresses, sending GET requests to internal HTTP(S) services and capturing responses in evidence files.