CVE Vulnerability Catalog

The HostList.list() method catches bare Exception and returns str(e) verbatim. Via host_filter, any authenticated user can trigger Django FieldError (leaking the complete Host model relation graph) or PostgreSQL DataError (leaking raw database error strings).

The /api/v2/config/ endpoint is protected only by IsAuthenticated, meaning any authenticated user receives license_info, including account numbers, subscription IDs, pool_id, SKU, support level, and instance counts. The superuser/auditor gate only covers other fields, not license_info.

The JobJobEventsChildrenSummary view has no model or parent_model, causing ModelAccessPermission.check_get_permissions() to return True for any authenticated user. The view uses raw get_object_or_404(Job, pk) without DRF object-level permission check, allowing a zero-privilege user to read event tree structure and enumerate Job IDs platform-wide.

URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 detail string. The differential "Not found." vs "No <Model> matches..." reveals whether a named resource exists on the platform.

OpenBao prior to 2.6.0 has a vulnerability in vault/policy/acl.go where a broader wildcard ACL grant could be evaluated before more specific trailing-wildcard ACL paths with capabilities = ["deny"] for a LIST operation. When a parent path permitted LIST and a child path was denied, the trailing-slash lookup could allow listing the denied path.

GoCD from 20.2.0 until 26.1.0 has a vulnerability where the internal pipeline structure API used for autocompletion returns its users-and-roles mode to regular authenticated users without requiring an administrator role. A lower-privileged user can enumerate configured user names and available role names.

GoCD from 20.2.0 until 26.1.0 has a vulnerability in the internal fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream that does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names.

BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. This can result in an out-of-bounds read.

BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. This can lead to memory corruption.

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check. This may allow unauthorized access.

BusyBox dpkg read_package_field() steps past a NUL terminator on malformed .deb packages, causing an out-of-bounds heap read. This may lead to data disclosure or a crash.

BusyBox httpd IP deny rules with invalid CIDR prefix lengths fail open, leaving a parsed IP with a zeroed mask so the rule matches no clients. This may result in failure to block unwanted addresses.

Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a Conversation record by its ID without comparing the requester's `user_id` to the conversation's owner `Conversation.user`. This allows any authenticated user to perform the following actions: 1. Read other user's chat transcripts, RAG retrieval history, AI-generated plots, and chat suggestions. 2. Permanently delete another user's conversation. 3. Rename another user's conversation. 4. Overwrite another user's conversation's chat suggestion list.

In Flatpak before 1.18.1, a malicious sandboxed application can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to write files to an arbitrary location. The file names and content are not attacker-controlled, making this difficult to exploit.

Plex Media Server before 1.43.3.10861 suffers from path traversal in '/system/agents/media/get' due to insufficient validation of the url parameter. An attacker with a valid session token can read arbitrary files accessible to the server user, including the PlexOnlineToken that grants full control.

PgBouncer through 1.25.2 lacks an upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server. A malicious or compromised PostgreSQL backend can cause uncontrolled CPU consumption in PgBouncer, and the key derivation cannot be interrupted in frontend builds.

alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow that defeats bounds checks. Attackers can supply crafted topology files that wrap size calculations, causing the decoder to read beyond the topology buffer.