CVE Vulnerability Catalog

crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl results to element.innerHTML. Attackers can craft malicious PDFs with event-handler markup to execute JavaScript in the Playground origin.

Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag_version and node_version.

A security flaw has been discovered in WuzhiCMS up to 4.1.0. This affects the function member::setAvatar of the file /index.php?m=member&f=user&v=setAvatar of the Avatar Upload component. The manipulation of the argument File results in unrestricted upload.

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL (Stored HTML Injection / Open Redirect).

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve employee records belonging to other departments and users.

The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via a crafted URL containing a malicious archive parameter.

webhookd prior to 1.22.0 forwards all incoming HTTP headers into the hook script environment without an allowlist when htpasswd authentication is not configured. If an upstream reverse proxy does not strip a client-supplied X-WebAuthn-User header and a hook script trusts that variable, a remote unauthenticated attacker can spoof another user, bypass script security controls, and access or modify resources.

ToolHive prior to 0.31.0 has a vulnerability in remote authentication where the client trusts the MCP server for authentication discovery destinations, allowing a malicious server to issue GET requests to internal services (link-local, RFC1918, cloud metadata) outside the server's container. This can lead to data exfiltration or privilege escalation.

qbee transport prior to 1.26.25 has a vulnerability in the extractTar routine that uses strictly lexical path validation without accounting for on-disk symlinks created earlier. A crafted tar archive can use a symlink chain to write files one directory level above the intended extraction path, and with root privileges permits a root-privileged file write outside the intended destination.

OpenBao prior to 2.5.5 has a vulnerability where an authenticated caller with write access to transit/keys/* can terminate the server process by setting derived to true while the type parameter selected rsa-, ecdsa-, or ed25519. A mutex double-unlock error leads to a panic, no HTTP response, and denial of service.

OpenBao prior to 2.5.5 uses EscapeLDAPValue (an RFC 4514 DN escaping function) where RFC 4515 LDAP search-filter escaping is required in GetUserDN. With the LDAP authentication backend configured for Active Directory, an attacker-controlled username containing filter metacharacters can alter the search predicate and select a different directory entry, allowing a token to be associated with another identity and gain access to its secrets.

OpenTelemetry Collector Contrib prior to 0.151.0 has a vulnerability in githubreceiver where RequiredHeaders validation is only performed at startup, not on incoming webhook requests. An unauthenticated sender can bypass the authentication control and submit arbitrary webhook payloads, and when the Secret field is empty, HMAC validation is also skipped, allowing injection of fabricated CI/CD data into the observability pipeline.

Capsule from 0.13.0 to 0.13.6 has a vulnerability in the validating webhook configuration where namespace/finalize is used instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label.

Signal K Server prior to 2.28.0 has a vulnerability in makeRemoteRequest() that accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters without validating the destination. When security is not configured, the endpoints testSignalKConnection, requestAccess, and checkAccessRequest are accessible without authentication, allowing port scanning, exfiltration of cloud metadata and internal service data, and lateral movement.

In Kiwi TCMS prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.

GitHacker 1.1.7 and earlier: add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/, allowing a malicious server to make GitHacker read an arbitrary local file when a victim runs the tool against the server's URL. add_hashes_parsed then scans the file for 40-character hexadecimal substrings and requests each match through .git/objects, creating an attacker-observable existence oracle and disclosing matching hexadecimal fragments. Complete file contents are not returned, and the write path in 1.1.7 does not permit an escape. This issue is fixed in repository version 1.1.9.

In SingularityCE and SingularityPRO prior to 4.4.2 and 4.3.9/4.1.14 respectively, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected.

In Decidim prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The question_title helper returns the translatable question body through html_safe without a sanitization boundary, causing stored script execution when visitors open public election pages or voting booth screens. The persisted script executes in visitors' browsers.

fluent-plugin-opentelemetry prior to 0.5.3: the in_opentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry ingestion endpoint was exposed to an untrusted network, an attacker could send an excessively large request or a highly compressed payload that expanded in memory. The resulting memory exhaustion could cause the operating system to terminate the Fluentd process, disrupting all log collection and forwarding on the affected node.

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.