CVE Vulnerability Catalog

Thumbor before 7.8.0 in the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist.

Stored XSS in participant URL handling in AWS Ops Wheel before PR #168. Allows an authenticated remote user to steal session tokens and escalate to full administrative control via a crafted participant_url with a dangerous URI scheme.

In hashi-vault-js before 0.5.2, src/Vault.js concatenates unencoded identifiers into Vault request paths and query strings without encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection.

In @phun-ky/defaults-deep before 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype (prototype pollution).

In DSSRF before 1.0.5, is_url_safe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing SSRF.

Wings, the server control plane for Pterodactyl, prior to version 1.13.0 contains a vulnerability causing a Go panic due to a malformed packet received during the SFTP connection handshake. This issue is fixed in version 1.13.0.

In the aap-gateway component of Ansible Automation Platform's Event-Driven Ansible (EDA), a vulnerability allows an unauthenticated remote attacker to bypass mTLS authentication for event streams. The attacker can manipulate the event stream URL and forge the HTTP Subject header, while the system inadvertently discloses the expected certificate subject in error messages.

In pgAdmin 4 from version 7.2 before 9.17, the MASTER_PASSWORD_HOOK setting allowed shell command injection via a username containing shell metacharacters (e.g., ';', '$()', backticks). The username from external auth sources (OAuth, Kerberos) could be used to execute arbitrary commands as the pgAdmin service account.

A vulnerability in pgAdmin 4 allows SQL injection via improper escaping of object names in query templates. A low-privileged user can create an object with an apostrophe in its name, which when another user opens the Statistics or Dependencies tab leads to arbitrary SQL execution in the database session.

The fast-uri library before versions 4.1.2, 3.1.5, and 2.4.4 incorrectly parses URIs when a backslash is used instead of a double forward slash. Node.js treats backslash as interchangeable with forward slash, leading to differences in host parsing. Applications using fast-uri for host-based policy enforcement can be steered to an unintended host.

In the Zephyr Bluetooth GATT client, in the gatt_write_ccc_rsp() function, a use-after-free vulnerability exists. Upon receiving an ATT Error Response from a GATT server, the function calls the notify(NULL) callback signaling subscription termination, then calls the subscribe() callback on the already freed structure, leading to use-after-free.

In gnome-remote-desktop as shipped in Red Hat Enterprise Linux, when the daemon runs in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler. This allows an unauthenticated remote attacker to open many parallel pre-authentication connections, exhausting resources and preventing legitimate users from establishing RDP sessions.

A SQL injection vulnerability has been identified in PHP Jabbers - PHP Poll Script in the pjAdminPolls.controller.php endpoint. An authenticated attacker can manipulate input data, leading to unauthorized SQL queries. This issue was fixed in version 4.1.

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. An authenticated user can manipulate parameters responsible for sorting functions, leading to unauthorized SQL queries. This issue was fixed in the versions specified in the affected products list.

The security fix for CVE-2025-66518 in Apache Kyuubi is incomplete. Any client with access to the Kyuubi server via frontend protocols can bypass the server-side config kyuubi.session.local.dir.allowlist using unprefixed Spark config aliases. This affects versions from 1.6.0 before 1.12.0.

Some Hikvision networking products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can send crafted packets containing malicious commands, leading to arbitrary command execution.

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base) in the get_ruvelement_from_berval() function. A remote unauthenticated attacker can send a crafted StartNSDS50ReplicationRequest with a replica ID field containing more than 16 digit characters, causing a crash of the LDAP server.

A flaw was found in 389 Directory Server where an unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV operation. Because the query runs with elevated privileges, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS) where processing Kubernetes Deployments replaces identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name, labels and namespace "default". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment.

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.