CVE Vulnerability Catalog

uhttpd is a small HTTP server. In unpatched repository snapshots, client_poll_post_data() in client.c consumes an invalid chunk-length line (e.g., a size exceeding INT_MAX), then clears r->content_length and r->transfer_chunked without draining the remaining body or setting request.connection_close. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization.

In LORIS versions from 22.0.0 before 27.0.4 and from 28.0.0 before 28.0.2, the `imaging_browser` module API permits edits to imaging data without checking the frontend edit permissions. An authenticated API caller can modify imaging data without the required edit authorization.

In LORIS versions from 16.0.0 before 27.0.4 and from 28.0.0 before 28.0.2, the `issue_tracker` backend does not correctly verify edit access permissions, although the frontend restricts which issues a user may edit. An authenticated user can submit backend changes to issues outside their permitted edit scope.

fickling through 0.1.12 incorrectly treats calls to functions from Python standard library modules as safe without inspecting their actual behavior. As a result, check_safety() returns LIKELY_SAFE for malicious pickle payloads that reach code execution or file writes through such callables (e.g., dataclasses._create_fn, mailcap.findmatch, readline.write_history_file). Because fickling.load() uses this verdict as a security gate before pickle.loads(), the payload is deserialized and executed with the privileges of the victim process.

A vulnerability in Trail of Bits fickling through 0.1.12 allows a pickle STACK_GLOBAL operand with a dotted __qualname__ (e.g., "Values.read_file") to be resolved by pickle's find_class via _getattribute to an arbitrary attribute path instead of a module-level function. Fickling records only the leading component in its import tracking and renders the operation as a plain import, so the trailing attribute reference is never analyzed as a call; the OvertlyBadEvals pass does not flag it and check_safety() returns LIKELY_SAFE with zero findings. This lets an attacker reach a class method that performs code execution (optparse.Values.read_file executes exec(open(filename).read(), vars)), achieving arbitrary code execution when the crafted pickle is loaded through fickling.load(), which chains check_safety() into pickle.loads() as an explicit security gate.

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields (billing and shipping address values and the customer order note) before outputting them in generated invoice and packing-slip documents. This allows unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.

Shopper is a headless e-commerce admin panel. Prior to 2.10.1, the customer detail route /cpanel/customers/{user}/show checks read_customers but looks up an arbitrary user ID without applying the customers role scope used by the listing. Authenticated staff holding access_dashboard and read_customers can change the user ID to retrieve administrator or staff profiles despite lacking view_users. The flaw exposes account profile data and permits user-ID enumeration; combined with delete_customers, it can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1.

A stored XSS vulnerability in the Shopper admin panel allows an authenticated staff member with content-upload permissions to store executable HTML or SVG files that are served without Content-Disposition or CSP headers. When an administrator opens such a file, the malicious script executes in their session and can create a new attacker-controlled administrator account with a chosen password. The issue affects versions 2.0.0 through 2.10.0 and 3.0.0-beta.1/beta.2, and is fixed in 2.10.1 and 3.0.0-beta.3.

In Shopper before 2.10.0, the Variants Livewire component in packages/admin/src/Livewire/Components/Products/Form/Variants.php exposes DeleteAction and DeleteBulkAction without server-side authorization. An authenticated staff user with edit_products can obtain the signed component state and permanently delete individual or multiple variants without the delete_product_variants permission. This can destroy the sellable catalogue and disrupt storefront product pages, cart, and checkout. The issue is fixed in version 2.10.0.

In jack before 0.1.0, middleware/handle-error.ts serializes raw FetchError objects into HTTP responses, and lib/servers/base.ts attaches outbound request headers on upstream non-success responses and schema-validation failures. The public extras field in lib/errors/FetchError.ts remains enumerable and is emitted by JSON serialization, exposing internal Radarr/Sonarr X-Api-Key and connector headers such as CF-Access-Client-Secret. The GET /peer/items/:id, GET /servers/health, and GET /torznab/download/:id endpoints can expose these secrets. The issue is fixed in version 0.1.0.

In Dream Displays from 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to yt-dlp under specific conditions. Unintended command-line options may be interpreted by yt-dlp, potentially altering its behavior. The issue is fixed in version 1.8.2.

In ZTNET before 0.8.0, any authenticated low-privilege user can permanently deactivate another account, including an administrator, via POST /api/auth/user/invalidateUser. The handler checks only that a session exists and does not compare session.user.id with the client-supplied userId, so supplying the victim's userId and a non-matching deviceId sets the target account's isActive to false and login is refused. The issue is fixed in version 0.8.0.

ESPAsyncWebServer before version 3.11.2 has a flaw in the multipart parser where it frees a buffer and sets it to NULL but still writes through the NULL pointer. This occurs when the byte after a file part boundary is not a valid terminator, causing a StoreProhibited exception and device reboot. The vulnerability requires a route with file upload or OTA handling.

SABnzbd before version 5.1.0Beta3 allows an attacker with a valid API key to invoke orphan job deletion with a path parameter that is not confined to the download directory. An absolute path can cause recursive deletion of files or directories writable by the SABnzbd process. The API key is stored in plaintext in the configuration file.

libriscv before version 1.18 allows a crafted ELF binary to cause out-of-bounds reads in the host emulator. The serialize_execute_segment and lookup functions trust section offsets and sizes without verifying them against the file size, potentially leading to SIGSEGV or host memory disclosure. The vulnerability is fixed in version 1.18.

Ring before version 1.15.5 has a vulnerability in the wrap-nested-params middleware, which uses a backtracking regular expression to match parameter names. An attacker can craft a parameter name that causes quadratic CPU consumption (O(n^2)), leading to denial of service. Ring-Defaults users are also exposed because the middleware is enabled by default.

MoLing in SSE mode (started with -l) does not authenticate requests to the /sse and /message endpoints, and the mcp-go dependency sets Access-Control-Allow-Origin: *. A malicious web page can open a cross-origin EventSource to /sse, read the sessionId, and send unauthorized MCP tool calls via /message, potentially leading to file read/write or command execution. The issue is fixed in version 0.5.0.

Picsou is a self-hosted personal finance dashboard. In the affected login implementation, the /api/auth/login endpoint reveals whether a username exists through a timing discrepancy: AuthController.login() throws BadCredentialsException immediately for an unknown username, before passwordEncoder.matches(...), whereas an existing username with an incorrect password incurs the bcrypt comparison cost. Both cases return the same generic HTTP 401 response, but repeated latency measurements disclose valid usernames without credentials. This issue is fixed in release 1.0.8.

In ThingLinks before 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed compilation and loading flow. An authenticated attacker can supply code that is compiled and executed on the server, leading to remote server-side code execution. The issue affects the rule engine's Groovy script test/register flow and is fixed in version 1.4.0.

In ThingLinks before 1.4.0, an unauthenticated SQL injection vulnerability exists in the TDengine TDS APIs. JSON field values submitted to /anyUser/tds/insertTableData reach unsafe SQL construction in the TDS mapper, allowing a remote unauthenticated attacker to tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The issue is fixed in version 1.4.0.