CVE Vulnerability Catalog

A missing authorization vulnerability in GitHub Enterprise Server allowed a repository collaborator with write access to delete the current default branch via the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories requiring pull-request review but not restricting branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content.

In the is_pd_allowed function in gem_msg.c, there is a missing permission check, allowing a permission bypass. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.

A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors. By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop, leading to high CPU utilization and service stalls.

Insertion of Sensitive Information Into Sent Data vulnerability in WordPress allows Retrieve Embedded Sensitive Data. This issue affects multiple WordPress versions from 6.6 through 7.1.2.

In ImageSharp from 2.0.0 to 4.1.2, ExifReader.ReadValues64 trusts the 64-bit BigTIFF IFD entry count and iterates once per declared entry. When fewer than 20 bytes remain, ReadValue64 returns without advancing the stream or terminating the loop, allowing a small malformed BigTIFF to keep a decoder thread executing for an attacker-controlled duration. Fixed in 4.1.2.

In ImageSharp from 1.0.0-beta0001 to 4.1.2, ICC CLUT parsing calculates allocation sizes from attacker-declared dimensions before confirming the profile contains the declared values. IccDataReader.ReadClutF32 can request a large float array, and earlier parsing paths can allocate large jagged representations from a short truncated profile. In version 4, automatic conversion reaches the parser when ColorProfileHandling is Convert; default Preserve avoids that path. Fixed in 4.1.2.

In ImageSharp from 4.0.0 to 4.1.2, ExrBaseDecompressor.UndoZipCompression accepts a nonempty ZIP or ZIPS inflate result shorter than the required EXR block size. ZipExrCompression.Decompress reconstructs the returned prefix while ExrDecoderCore processes the full expected block from a buffer obtained through Configuration.Default, allowing bytes from a completed prior ImageSharp operation to appear in decoded pixels. Applications exposing pixels or output from the later attacker-controlled EXR decode can disclose process-local image data. Fixed in 4.1.2.

In Quasar Framework from 1.0.0 to 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir before building without rejecting the project root, user home directory, filesystem roots, or symlink-resolved external directories. An unsafe trusted configuration can delete data writable by the build user before compilation begins. No attacker-controlled input reaches build.distDir by default, so exploitation requires compromised or less-trusted automation or a mistaken configuration. Fixed in 3.3.0.

Bludit CMS 3.22.0 has an issue that allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints.

JetBrains TeamCity before 2026.2.1 contains a vulnerability due to missing validation of Git submodule URLs, allowing reading local repositories on the server. Attackers can exploit this to access confidential data.

SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in an unknown function of the file /opils/admin/view_product.php. Manipulation of the Category argument allows remote attack. The exploit is public.

In Payload CMS, the @payloadcms/storage-s3 package in versions before 3.90.0 and canary versions before 4.0.0-canary.34 allows an authenticated user to overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for multiple collections sharing a bucket and useCompositePrefixes is false or unset. This bypasses the target collection's access controls and prior file validation.

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user limited to one tenant can create a record in another tenant when at least one tenant-enabled collection exists. Reads and direct edits of existing documents in the target tenant are not bypassed.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, token refresh responses and password reset responses can independently return hidden or read-restricted fields that the requesting user cannot access. Fixed in versions 3.90.0 and 4.0.0-canary.34.

In Payload versions from 3.0.0 before 3.90.0 and canary before 4.0.0-canary.34, a user who can query a collection with a polymorphic join to sensitive fields can infer hidden or read-restricted values, including password-reset tokens, through polymorphic join filters. Fixed in versions 3.90.0 and 4.0.0-canary.34.

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes.

Dbit WIFI4 N300 devices version 1.0.0 allow administrators (from the local Wi-Fi network) to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.