CVE Vulnerability Catalog

The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the server apply update operators instead of a full replacement. The effect is limited to the document matched by the application's own filter, whose contents can be modified in ways the application did not intend.

A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document from externally supplied binary data, the driver does not verify that the declared size matches the actual data provided and copies it unchanged. An unauthenticated party supplying binary content can insert or remove elements in the database command without database credentials.

A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer allocation when an excessively long credential value is supplied in the client's connection configuration. A party controlling that configuration can cause the driver to write outside the allocated buffer. This may corrupt client process memory and cause denial of service of the client application.

The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness when deserializing one BSON value type. An application deserializing untrusted content retains derived data for the process lifetime with no limit. An unauthenticated remote party can drive unbounded memory growth, exhausting available memory and denying service.

The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application placing user-supplied field names into these extra members can store documents with duplicate geometry fields, so the server and driver resolve different values for the same record. Affected records can also become unreadable through the driver.

MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3.

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.

Roskus Prospero Flow CRM versions 2.0.0 through 5.26.0 lack authorization in the user API. A user with a basic role can read other users' accounts within their company (including higher-privileged accounts) and, from version 3.5.0, delete them, because the GET and DELETE /api/user/{id} routes only require a valid JWT and perform no permission, policy, or role check.

SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents.

On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, a user granted subscription-creation permissions may be able to query and read resources they are not otherwise permitted to access. The flaw stems from insufficient authorization checks on subscriptions.

A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary JavaScript in the context of the user's browser via a crafted URL.

An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessible URL. When such a URL is passed as templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content can be executed in the context of the Docker container.

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.

The Agent Zero Web UI before version 1.15 does not properly sanitize user-provided input in chat messages or file uploads. When Agent Zero renders content in the chat interface, injected JavaScript executes in the context of the victim's authenticated Agent Zero Web UI session.

Canonical Juju versions 4.0 through 4.0.15 lack authorization in the unit resources download route. A controller-authenticated principal (a unit agent or a user with only login permission) can read any application's charm resources in any model, including container-registry credentials, via a crafted request naming an arbitrary unit.

ast-cli downloads two helper binaries, the Vorpal ASCA engine and the SCA Resolver, from download.checkmarx.com as part of its auto-update flow, triggered by Checkmarx VSCode/JetBrains extensions and cx scan sca-realtime. Prior to the fix, the downloaded archive was not verified against a checksum before extraction and execution. An attacker able to substitute the served archive could deliver an arbitrary binary that ast-cli would extract and execute.

Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when installing Vorpal ASCA and SCA Resolver) allows a malicious tar archive with absolute or traversal path entries to write files outside the install directory. Windows builds were not affected, as the Windows extractor performs this path validation.

CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, the pull_request_target workflow is vulnerable to cache poisoning and OIDC token theft. It checks out fork code using github.event.pull_request.head.sha or .head.ref, giving attacker-controlled code access to base repository secrets and tokens. A poisoned cache entry written by the workflow can execute during a subsequent release or publish workflow that restores from the same cache scope.

Supabase Realtime prior to version 2.103.1 accepts an expired JWT on REST broadcast endpoints when the exp claim is encoded as a JSON string instead of a number. This allows an unauthenticated attacker to broadcast realtime messages to subscribers.

ABB Ability Edgenius through version 3.2.3.0 has a missing authentication for a critical function vulnerability. The flaw allows access to a function that requires authentication without performing it.