CVE Vulnerability Catalog

A flaw in util-linux: Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to bind another host directory. If the fstab entry also sets X-mount.owner, X-mount.group, or X-mount.mode, root then changes ownership or mode on that redirected inode.

The X-mount.subdir option uses a detached-tree fast path on Linux 6.15 and later and passes the configured subdirectory to open_tree() with AT_SYMLINK_NOFOLLOW. That flag does not stop intermediate symlink traversal or keep resolution inside the newly mounted filesystem. A local unprivileged user with an fstab-authorized X-mount.subdir entry can attach a host path at the intended mountpoint.

The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes.

A vulnerability in NGINX JavaScript where a malformed HTTP response received by ngx.fetch() can crash an NGINX worker when trusted JavaScript reads Response.statusText. Exploitation requires control or influence over the fetched HTTP response.

A vulnerability in NGINX Ingress Controller where the configuration generator does not sanitize user-controllable fields from Ingress annotations. An authenticated attacker with permission to create or modify these annotations can inject arbitrary NGINX configuration directives.

A vulnerability in BIG-IP where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI).

A vulnerability in NGINX Gateway Fabric where user-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret, are rendered directly into NGINX configuration templates without sanitization or escaping.

A vulnerability in NGINX JavaScript (njs) and QuickJS (qjs) engines where an exception during asynchronous access-control evaluation can cause the js_access phase to fail open, allowing the request to proceed instead of being denied.

A vulnerability in the mobile Smart Connect dashboard UI where it can be manipulated by 3rd party apps. When paired with a phishing attack, this could result in escalated privileges of an attacker within the system.

A vulnerability in Grafana (only self-managed instances with Auth Proxy authentication and identity caching enabled) where the Auth Proxy cache key concatenates username and forwarded identity attributes without a delimiter, allowing distinct identities to collide. An authenticated user can spoof a higher-privileged user.

A vulnerability in Craft CMS where GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from arguments without passing through ArgumentManager::prepareArguments(), bypassing site-scope filtering. An attacker with a token scoped to Site A can create, modify, or delete entries in Site B.

A vulnerability in Craft CMS where GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteId directly from arguments without passing through ArgumentManager::prepareArguments(), bypassing site-scope filtering. An attacker with a token scoped to Site A can create, modify, or delete entries in Site B.

The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elevated session. It also allows the attacker to change other users' passwords if the attacker's account has 'Edit users' permission (which doesn't allow changing others' passwords) and lacks 'Administrate users' permission (which is required to change others' passwords).

Incorrect permission assignment for critical resources in Elastic Agent on Windows systems can lead to local privilege escalation. A local user can exploit overly broad access controls to execute arbitrary code and gain SYSTEM privileges.

A path traversal vulnerability in the Kibana Fleet feature can lead to unauthorized deletion of privileged resources. A low-privileged user with Fleet Settings write access could cause administrative actions to affect unintended internal resources, such as user accounts.

The Auto x LINE WordPress plugin through 1.0.0 lacks authorization checks in some REST endpoints, allowing unauthenticated users to update plugin settings, clear logs, etc.

A vulnerability in affected products allows an attacker with basic user privileges to gain access to users' projects. The attacker can modify and delete projects.

Vulnerability in Drupal Screenshot. Affects all versions.

Vulnerability in Drupal Screenshot. Affects all versions.

Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can generate a valid reset URL and set a new password, enabling complete control-panel takeover.