CVE Vulnerability Catalog

The app/process-api-response-headers action accepts fake Craft API response headers from any authenticated control panel user; a user with only accessCp can place newline characters in X-Craft-Plugin-Licenses, injecting a new attacker-known CRAFT_SECURITY_KEY into .env and forging a signed redirect with a Twig system() callback.

Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString().

Happy DOM from 17.0.0 until 21.0.4 in ECMAScriptModuleCompiler.ts accepts a named ESM import alias without validating it as a JavaScript binding identifier; with enableJavaScriptEvaluation enabled, attacker-controlled HTML or module source can cause generated JavaScript to execute in the Node.js host process.

Wasmtime prior to 36.0.19, 48.0.7, and 49.0.4 has a flaw in the Cranelift compiler on aarch64. A br_table instruction with more than ~256,000 targets can be miscompiled, allowing a jump to arbitrary code and sandbox escape.

Wasmtime from 46.0.0 until 48.0.7 and 49.0.4, when lowering a host-created component-model stream or future into a guest, can omit a required payload-type check after the value passes through guest code and returns via StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader; a malicious guest can panic the Wasmtime host.

Wasmtime prior to 36.0.19 and 43.0.0 has a flaw in the Cranelift compiler where SSA value indices can silently overflow when compiling large Wasm functions. This can cause miscompilation, type confusion, and sandbox escape.

GraphQL Scalars from 1.24.1 until 2.0.1 in GraphQLPhoneNumber uses ambiguous nested digit quantifiers that backtrack exponentially when a value contains a run of digits followed by a failing character; parseLiteral and parseValue are evaluated before authentication, so a small unauthenticated request can block the Node.js event loop.

MLflow from 3.12.0rc0 until 3.17.0 in the scorer invoke, register, and GenAI evaluate endpoints (including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke) accepts serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or constructor arguments; with trulens and trulens-providers-litellm installed, an attacker can force an outbound request to a chosen host with controlled headers and body.

In LangGraph CLI from 0.4.15 until 0.4.32, 'langgraph deploy --verbose' passes a temporary registry push token on standard input to 'docker login --password-stdin', but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image.

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with '.'.join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_namespaces, their asynchronous equivalents, or direct batch and abatch operations can resolve to another tenant's stored namespace, allowing cross-namespace reads, overwrites, or deletion. InMemoryStore is not affected because it compares namespace tuples.

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the JSON Config File Handler component. The manipulation of the argument hidden_dim/class_num results in out-of-bounds read. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor explains: 'khaiii treats the resource directory (--rsc-dir) as trusted input, like a binary or a shared library. To use this defect, an attacker must already be able to write to that directory. With that access, an attacker can change the analysis results without this defect.' This vulnerability only affects products that are no longer supported by the maintainer.

In Twisted before 26.10.0rc1, twisted.names.dns.DNSDatagramProtocol accepts a UDP DNS response for a pending query when its 16-bit transaction ID matches but does not verify that the response came from the queried host and port. An attacker able to deliver a packet with the correct transaction ID can inject a forged answer.

In OpenReception versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. The product's design guarantees that appointment data is end-to-end encrypted to staff members and that the staff recipient directory is not attacker-writable, so that even administrators and the operator cannot read patient data. This endpoint breaks that guarantee for an unauthenticated remote actor: it allows writing an arbitrary encryption recipient into the recipient directory of any tenant. The injected key receives the tunnel key of every appointment booked afterward in that tenant, because booking clients encrypt to all active staff keys. The attacker holds the corresponding secret key and is a persistent, unauthorized recipient of that key material. At time of publication, there are no publicly available patches.

In OpenReception prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.

In OpenReception versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online within the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel with end-to-end-encrypted data and the ability to act as the client, e.g. adding or cancelling appointments. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. At time of publication, there are no publicly available patches.

In OpenReception prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.

In OpenReception prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker sending one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker; if clicked, the one-time token reaches the attacker, who confirms the account on the real tenant domain and registers a passkey they control, taking over the account. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator with explicit per-tenant proxy blocks is not affected. This issue has been patched in version 2.0.0.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical details about the vulnerability are available.

In Twisted prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the Convertor component. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.