CVE Vulnerability Catalog

undici, an HTTP client library for Node.js, in versions 6.23.0-6.29.0, 7.18.0-7.30.0, and 8.0.0-8.12.1 crashes the Node.js process when a malicious server returns a response with more than five content codings and closes the connection before sending the body. undici rejects the response due to a content-encoding limit, but the internal response stream was created before that check without an error listener or request abort, so the early close surfaces an unhandled error and terminates the process.

The undici library (versions 7.15.0-7.30.0, 8.0.0-8.12.1) has a vulnerability in its fetch() implementation that verifies Subresource Integrity (SRI) metadata by matching the algorithm token against a lowercase-only set, so a valid but non-lowercase token (e.g., uppercase SHA256) is treated as unknown and skipped, causing the response to be accepted without integrity check.

undici in versions 7.0.0-7.30.0 and 8.0.0-8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, builds the cache key from the original request URL before the redirect handler changes the origin. A response produced after a cross-origin redirect is stored under the original key, allowing persistent cache poisoning and disclosure of private data to a later unauthenticated caller.

The Sunshine Photo Cart plugin for WordPress (up to version 3.7.4) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthenticated or low-privileged user can access functionality that should be protected.

undici in versions 4.0.0-6.29.0, 7.0.0-7.30.0, and 8.0.0-8.12.1 passes Agent constructor options through a JSON-based deep clone before forwarding them to each per-origin pool. Because JSON cannot represent functions, a caller-supplied tls option containing a checkServerIdentity callback is silently dropped, so a TLS peer whose certificate the custom callback was written to reject but which passes Node's default checks is silently accepted.

In the Ansible Automation Platform UI (Hub module, DocumentationParsers.tsx), documentation links are rendered without restricting the URL protocol/scheme. A collection with a link using a script-executing scheme can cause script execution in the browser of another authenticated user who clicks it — a stored XSS issue.

The Knowledge Base plugin by WebberZone (up to version 3.2.0) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can access protected functionality.

A flaw in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can supply a crafted path, header, or query match value that causes the predicate to skip those checks, while the request is still forwarded to the route's backend.

temporal-proxy versions 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. The proxy selects the decryption key based on an identifier in the payload rather than the request namespace, allowing an attacker authorized for namespace B to decrypt a payload from namespace A.

ELADMIN version 2.7 and earlier is vulnerable to Cross Site Scripting (XSS) via the WebSocketServer, SpringSecurityConfig, and deploy.vue components. Improper input neutralization allows injection of malicious script.

The YITH WooCommerce Compare plugin (up to version 3.15.0) has an improper neutralization of input during web page generation vulnerability, leading to stored XSS. A malicious script can be persistently stored and executed in the user's browser.

The bandit library (versions 0.6.0 to 1.13.0) improperly validates syntactic correctness of input. An unauthenticated remote attacker can set conn.host and conn.port to values outside the RFC 3986 host grammar via the authority of an HTTP/1 absolute-form or authority-form request target, potentially injecting malicious values into URLs generated by the application.

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup, changing the document's semantics.

react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 1.0.0 until 1.11.1, React\Http\Browser uses ClientRequestStream::handleData() to append response-header bytes to an internal buffer without enforcing a size limit. A remote server can send a valid status line and partial header, withhold the \r\n\r\n or \n\n terminator, and continue streaming data so the buffer grows for the life of the connection.

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use.

The ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin (up to version 1.5.3) has an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4, joserfc.jws.deserialize_json() accepts a JWS General JSON Serialization with an empty signatures array as authenticated. The verify_general_json() loop performs no iterations for the empty array and returns success because no signature check failed, allowing an attacker without a signing key to supply an arbitrary payload that relying applications may treat as authentic. The issue affects the General JSON Serialization path; compact JWS and JWT decoding, Flattened JSON serialization, and JWE JSON processing do not follow this vulnerable path. This issue is fixed in version 1.7.4.

An unauthenticated remote attacker can bypass authentication and gain full access to administrative API endpoints in Nutanix Prism Element by including a crafted internal management HTTP header. The vulnerability is caused by a misconfiguration in the application's authentication filters. Consequently, the server responds with a Set-Cookie header containing a valid JSESSIONID. This session cookie decodes to a JSON Web Token (JWT) granting maximum cluster administrative privileges. Successful exploitation allows the attacker to execute root-level commands on all Controller VMs (CVMs) in the cluster, leading to complete cluster destruction and unauthorized access to VM memory and virtual disks.

OpenPrinting CUPS before version 2.4.20 has a flaw in copy_banner() that uses the attacker-controlled attributes-natural-language value as a directory component. This allows escaping the banner directory and copying an arbitrary file into a spool object that can be delivered to the attacker.

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.