CVE Vulnerability Catalog

The pglogical queue mechanism executes message payloads on the subscriber with PostgreSQL superuser privileges. A publisher can send crafted messages to execute arbitrary SQL as superuser, escalating privileges and breaking tenant isolation.

Nebula Mesh versions 0.3.5 and below do not apply per-operator CA scoping in the web UI, allowing any authenticated non-admin operator to access resources belonging to other operators. This was partially fixed in GHSA-598g-h2vc-h5vg but the web UI was not covered.

Bridge is affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution in the context of the current user. A low-privileged attacker can exploit it. Requires user interaction (opening a malicious file).

Bridge is affected by an Incorrect Authorization vulnerability that could lead to privilege escalation. An attacker can gain unauthorized read and write access. Requires user interaction (opening a malicious file).

Bridge is affected by a Path Traversal vulnerability that could lead to arbitrary file system read. Requires user interaction (opening a malicious file).

nebula-mesh versions prior to 0.3.2 do not perform admin checks on the audit log endpoint. Any operator with an API key can read the full audit log, including cross-tenant data.

A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection, allowing it to spoof process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs.

In firmware versions 2.7.7 and earlier, the Arris BGW210-700 gateway fails to enforce any server-side authentication on its /cgi-bin/*.ha management endpoints, relying solely on client-side CSS/JavaScript gating. Unauthenticated attackers on the LAN can read sensitive configuration data, modify persistent device settings, or trigger backend diagnostic operations.

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials.

The WP Password Policy plugin for WordPress up to version 3.7.1 is vulnerable to Privilege Escalation due to missing authorization checks and nonce verification in the get_user() function. An authenticated attacker with subscriber-level access can escalate their privileges to Administrator by submitting a crafted POST request.

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests and the server-side authorization token to an attacker-controlled endpoint.

PhpSpreadsheet in many versions is vulnerable to a DoS attack via OLE file reading. The OLE reader follows sector chains from attacker-controlled XLS/OLE metadata without detecting cycles. A tiny malformed .xls file can cause the reader to repeatedly append the same sector data until PHP memory is exhausted.

PhpSpreadsheet in many versions is vulnerable to SSRF via bypass of the WEBSERVICE() domain whitelist. The webService() function validates the URL host against the whitelist, but PHP automatically follows HTTP 301/302 redirects and the redirect target is not re-validated. An attacker can upload an XLSX file that, when the WEBSERVICE() formula is calculated, causes access to arbitrary URLs, including internal addresses.

In the Python SDK pytonapi versions 2.0.0 to 2.2.0, TonapiWebhookDispatcher fails to validate the Authorization header when a webhook handler is registered with a custom path. An unauthenticated remote attacker can POST forged payloads to the custom webhook endpoint and trigger victim-defined handlers.

Adobe Photoshop Installer is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. An attacker can place a malicious library in a directory searched by the installer. Exploitation requires user interaction (running the installer).