Arbitrary File Access

Docling is vulnerable to arbitrary file read and write. The vulnerability is due to the Tectonic engine compiling untrusted TikZ input without restricting file access, which allows an attacker to read accessible files and create or overwrite writable files, with potential command execution if she...

Use-after-free

The zstd-jni library is vulnerable to a use-after-free. The vulnerability is due to improper memory management during dictionary loading, which allows a remote attacker to potentially exploit the freed memory and compromise application stability or security...

Sensitive Information Disclosure

Docling is vulnerable to sensitive information disclosure. The vulnerability is due to the HTML image resource loader forwarding configured headers to remote image URLs without restricting them to the source document’s origin, which allows an attacker to expose configured credentials, such as API...

Denial Of Service (DoS)

com.rabbitmq:amqp-client is vulnerable to Denial-of-service DoS. The vulnerability is due to the JSONReader.read method failing to terminate when parsing truncated strings or unterminated line comments, which allows an attacker to exhaust heap memory or consume excessive CPU resources through...

Cross-Site Scripting (XSS)

Ghost is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to imported SVG images being stored without sanitization, which allows an attacker to convince an Administrator to import a crafted file and host malicious scripts on the site's domain, potentially compromising staff users'...

Use After Free

zstd-jni is vulnerable to Use-After-Free. The vulnerability is due to streams and contexts releasing a dictionary's shared lock after the load operation while retaining references to the dictionary, which allows an attacker to close the dictionary and cause subsequent operations to access freed...

Out-of-Bounds Read

zstd-jni is vulnerable to Out-of-Bounds Read. The vulnerability is due to failure to validate the samples buffer capacity in Zstd.trainFromBufferDirect, which allows an attacker to supply oversized sample lengths that cause the native implementation to read beyond buffer boundaries, potentially...

Out-of-Bounds Read

zstd-jni is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper 32-bit signed bounds checking of direct-ByteBuffer frame-size native methods, which allows an attacker to provide negative or overflowing offsets to read unintended memory locations, potentially causing JVM...

Out-of-bounds Memory Read

zstd-jni is vulnerable to an out-of-bounds memory read. The vulnerability is due to insufficient validation of untrusted offset and length values, which allows an attacker to read data from the native heap into the compression dictionary, potentially causing JVM crashes...

Improper Control Of Generation Of Code

org.apache.syncope.core, syncope-core-spring is vulnerable to Improper Control of Generation of Code. The vulnerability is due to insufficient validation of administrator-provided Groovy Command classes in the CommandArgs static implementation, which allows an attacker with sufficient...

Directory Traversal

handlebars-springmvc is vulnerable to Path Traversal. The vulnerability is due to percent-encoded traversal sequences bypassing path-containment checks before URL decoding, allowing a request-derived view name to access files outside the configured template directory...

Privilege Escalation

Apache Syncope is vulnerable to privilege escalation. The vulnerability is due to the disclosure of the JWKS configuration for internal JWT authentication, where an attacker can obtain admin privileges after completing a successful authentication and acquiring a valid low‑privilege JWT...

Authentication Bypass

Apache Syncope is vulnerable to authentication bypass. The vulnerability is due to the disclosure of the configured JWKS settings for internal JWT authentication, where an attacker can spoof another user's privileges after completing a successful authentication and obtaining a valid JWT...

Remote Code Execution(RCE)

Ghost is vulnerable to a remote code execution. The vulnerability is due to improper handling of attacker-controlled SVG content in the bundled image processing library, which allows an attacker to create a malicious bookmark card through a website they control and execute arbitrary commands on t...

Prompt Injection Bypass

PraisonAI is vulnerable to a Prompt Injection Bypass. The vulnerability is due to the block threshold defaulting to CRITICAL severity, which allows an attacker to submit instruction override or financial manipulation prompts that evade blocking, potentially enabling system prompt extraction and...

Improper Access Control

Payload is vulnerable to improper access control. The vulnerability is due to insufficient enforcement of the access.update restriction, which allows an attacker with appropriate access to bypass the restriction and modify a user's password...

Improper Neutralization Of Special Elements In Data Query Logic

MongoDB Python Driver is vulnerable to Improper Neutralization of Special Elements in Data Query Logic. The vulnerability is due to improper handling of caller-supplied structured file identifiers, which allows an authenticated attacker to manipulate GridFS queries to access unintended stored fil...

Denial-of-service (DoS)

geopy is vulnerable to a Denial-of-service DoS. The vulnerability is due to excessive CPU consumption when parsing long, malformed coordinate strings, which allows an attacker to cause denial of service by repeatedly sending attacker-controlled requests containing crafted input...

Null Byte Injection

Netty is vulnerable to null byte injection. The vulnerability is due to the MqttEncoder not validating client identifiers, topics, usernames, and PUBLISH topic names before encoding, where prohibited null bytes can be inserted into MQTT UTF-8 string fields and attackers can exploit this by...

Arbitrary Code Execution

Apache Syncope is vulnerable to an Arbitrary Code Execution. The vulnerability is due to imported BPMN processes allowing unsandboxed Groovy scriptTask execution, which allows an attacker with sufficient administrative entitlements to import and start a malicious BPMN process through the REST API...

Server-Side Request Forgery (SSRF)

org.apache.syncope.core.idm, syncope-core-idm-logic is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of user-controlled requests, which allows an authenticated low-privileged attacker to make the server send requests to arbitrary internal or...

Denial-of-service (DoS)

org.apache.qpid, protonj2 is vulnerable to a Denial-of-service DoS. The vulnerability is due to excessive type nesting during message processing, which allows a pre-authentication attacker to trigger deeply nested types and cause a StackOverflowError...

Denial-of-service (DoS)

org.apache.qpid, protonj2 is vulnerable to a denial-of-service DoS. The vulnerability is due to improper handling of the session flow-control incoming window, which allows an authenticated attacker to exceed the allowed window and potentially exhaust resources...

Path Traversal

Apache MINA SSHD is vulnerable to path traversal. The vulnerability is due to insufficient path validation on Windows, where the sshd-git component fails to properly restrict file system paths and an authenticated remote user can craft directory traversal sequences to access git repositories...

Denial-of-service (DoS)

org.apache.qpid, qpid-broker-plugins-amqp-1-0-protocol is vulnerable to a Denial-of-service DoS. The vulnerability is due to improper handling of type size/count values, which allows a pre-authentication attacker to trigger excessive memory allocation...

Improper Limitation Of A Pathname To A Restricted Directory

Werkzeug is vulnerable to Improper Limitation of a Pathname to a Restricted Directory. The vulnerability is due to safejoin failing to remove an empty NTFS Alternate Data Stream ADS marker before checking Windows device names, which allows an attacker to request a path ending in NUL: and cause th...

Authorization Bypass

langgraphsdk is vulnerable to an authorization bypass. The vulnerability is due to the @auth.on.threads, @auth.on.assistants, and @auth.on.crons decorators ignoring the specified actions argument, which allows an authenticated attacker to bypass fallback permission or ownership checks and read,...

Path Traversal

Docling is vulnerable to Path Traversal. The vulnerability is due to improper validation and confinement of attacker-controlled xlink:href filesystem paths when processing ODF images, which allows an attacker to access arbitrary readable files and potentially disclose their contents through...

Sensitive Data Leakage

Snowflake drivers are vulnerable to Insertion of Sensitive Data Leakage. The vulnerability is due to sensitive data such as authentication tokens, encryption keys, pre-signed cloud-storage URLs, and SAML assertions being written to diagnostic logs, which allows an attacker with read access to the...

Cross-site Scripting (XSS)

ProseMirror is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient validation of attributes in clipboard slice context during paste handling, which allows an attacker to craft malicious HTML that executes attacker-controlled JavaScript in the browser window containing...

Path Traversal

Apache Kyuubi is vulnerable to Path Traversal. The vulnerability is due to the use of the client‑supplied multipart filename when creating a temporary uploaded resource, where the filename is not validated and path traversal sequences such as ../ can be included, allowing a remote attacker to wri...

Path Traversal

Apache Jena Fuseki is vulnerable to Path Traversal. The vulnerability is due to insufficient validation of file paths, where the server fails to properly restrict directory traversal in request handling and attackers can craft malicious ../ sequences to read arbitrary files on the system...

Denial-of-service (DoS)

org.apache.qpid, qpid-broker-plugins-amqp-1-0-protocol is vulnerable to a Denial-of-service DoS. The vulnerability is due to type nesting that can trigger a StackOverflowError, which allows a pre-authentication attacker to send specially crafted nested data and potentially crash the broker...

Remote Code Execution (RCE)

Apache Syncope is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper isolation of the connector subsystem, where scripted connectors REST and SQL can execute Groovy scripts and an attacker with sufficient privileges can trigger this capability to achieve remote code...

Prototype Pollution

isomorphic-git is vulnerable to prototype pollution. The vulnerability is due to insufficient validation of ref names in the getRemoteInfo function, where a malicious Git server can advertise crafted ref names containing proto path segments e.g., proto/corsProxy that pollute Object.prototype, and...

Cross-Site Request Forgery (CSRF)

Apache JSPWiki is vulnerable to JSON Hijacking. The vulnerability is due to insecure handling of JSON responses, where the data can be accessed cross‑origin via a tag and attackers can exploit it to perform CSRF attacks and steal information...

Improper Privilege Management

Apache Syncope is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient authorization checks in certain user workflow configurations, which allows an authenticated user to grant themselves defined Roles through a REST API and gain their associated entitlements,...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to Resource Exhaustion. The vulnerability is due to improper handling of type size/count, where excessive memory allocation can occur and a pre-authentication attacker can trigger it to cause a denial of service...

Denial Of Service (DoS)

t-digest is vulnerable to a Denial-of-service. The vulnerability is due to insufficient validation of crafted serialized digest header fields in MergingDigest.fromBytes, which allows an attacker to provide maliciously serialized digests with mismatched values and trigger...

Improper Certificate Revocation Checking

mwiede jsch is vulnerable to improper certificate revocation checking. The vulnerability is due to improper validation of revoked keys in the getRevokedKeys function of KnownHosts.java, which allows a remote attacker to bypass certificate revocation checks by manipulating the knownhosts argument...

Missing Authorization

Apache HBase is vulnerable to Missing Authorization. The vulnerability is due to missing owner checks in the fetch and close steps, where the server uses the scanner ID returned by the open step to identify scanner instances but fails to verify that the ID belongs to the requesting user, allowing...

Server-Side Request Forgery (SSRF)

java-json-tools jackson-coreutils is vulnerable to server-side request forgery SSRF. The vulnerability is due to improper URL validation in the JsonLoader.fromURL function, which allows a remote attacker to manipulate the URL and cause the server to send unauthorized requests to attacker-controll...

Unsafe Reflection

Apache IoTDB is vulnerable to Unsafe Reflection. The vulnerability is due to the pipe processor instantiating an externally supplied class name using Class.forName.newInstance without validation or allowlisting, allowing an attacker to instantiate arbitrary classes...

Configuration Bypass

Apache Kyuubi is vulnerable to configuration bypass. The vulnerability is due to an incomplete security fix, where client‑controlled unprefixed Spark config aliases can bypass the server‑side kyuubi.session.local.dir.allowlist setting and attackers can exploit it by accessing the Kyuubi Server vi...

Denial Of Service (DoS)

figlet.js is vulnerable to Denial Of Service DoS. The vulnerability is due to an unbounded loop when whitespaceBreak is enabled and the configured width is smaller than a rendered FIGlet character, which allows an attacker to trigger repeated processing that consumes excessive CPU and memory,...

Denial Of Service (DoS)

basic-ftp is vulnerable to Denial Of Service DoS. The vulnerability is due to excessive backtracking in the Unix directory listing parser when processing crafted FTP responses, which allows a malicious or compromised FTP server to consume excessive CPU and block the Node.js event loop, causing a...

Prototype Pollution

piscina is vulnerable to Prototype Pollution. The vulnerability is due to storing security-sensitive ThreadPool.options in a plain object that inherits attacker-influenced properties, which allows an attacker with a separate prototype-pollution primitive to inject values such as execArgv,...

Uncontrolled Resource Consumption

Apache Qpid ProtonJ2 is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the lack of a limit on the number of transfer frames per incoming delivery, which allows an authenticated attacker to cause excessive resource consumption and potentially trigger a denial-of-servi...

Resource Exhaustion

Apache Qpid ProtonJ2 is vulnerable to resource exhaustion. The vulnerability is due to unbounded symbol value caching, where symbol values are cached without size limits and a pre-authentication attacker can send crafted input to exhaust resources, leading to denial of service...

Uncontrolled Resource Consumption

Apache Qpid Broker-J is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded caching of symbol values, which allows a pre-authentication attacker to exhaust server resources and cause a denial-of-service condition...