Privilege Escalation

FileGator is vulnerable to Privilege Escalation. The vulnerability is due to insufficient validation of user-supplied file permission values, where arbitrary Unix permission modes are passed directly to chmod, allowing authenticated users with chmod permission to escalate privileges to root...

Sensitive Information Exposure

OpenClaw is vulnerable to Sensitive Information Exposure. The vulnerability is due to insufficient enforcement of credential redaction during trajectory exports, where lower-trust callers can exploit misconfigured input paths or feature access to expose sensitive credentials and other protected...

Improper Authorization

OpenClaw is vulnerable to Improper Authorization. The vulnerability is due to insufficient enforcement of network access policies in the sandbox exec-server, allowing lower-trust callers to bypass configured restrictions and send HTTP requests to internal network resources that should be...

Remote Code Execution

fastjson is vulnerable to remote code execution RCE. The vulnerability is due to insecure deserialization in Fastjson, where specially crafted input can trigger arbitrary code execution under the default configuration without requiring AutoType to be enabled or any classpath gadget...

Authentication Bypass

Grav is vulnerable to Authentication Bypass. The vulnerability is due to insufficient authorization checks during two-factor authentication setup, where attackers who know a victim's password can overwrite the 2FA secret during the pending TOTP challenge, allowing them to bypass two-factor...

Cross Site Scripting

Grav is vulnerable to Cross Site Scripting. The vulnerability is due to the XSS blueprint validator running on raw page content before Twig processing, where an attacker with page-write API permission can use Twig's string concatenation operator to dynamically construct event handler names, and...

Code Injection

Kiota is vulnerable to Code Injection. The vulnerability is due to improper sanitization of OpenAPI documentation fields before generating C XML documentation comments, which allows an attacker to inject arbitrary C code into generated client source files...

Uncontrolled Resource Consumption (Denial Of Service)

PhpSpreadsheet is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the OLE reader following attacker-controlled sector chains without detecting cycles or enforcing a maximum chain length, which allows an attacker to upload a specially crafted .xls/OLE...

Path Traversal

dompdf/dompdf is vulnerable to Path Traversal. The vulnerability is due to an improper prefix validation in the validateLocalUri method, where normalized paths are checked using strpos without enforcing directory boundaries, which allows an attacker who can control rendered HTML to escape the...

Information Exposure

dompdf/dompdf is vulnerable to Information Exposure. The vulnerability is due to insufficient validation of data-URI embedded SVG elements, which allows an attacker to reference local files through the href or xlink:href attributes and exploit differences in file processing behavior to leak...

Denial Of Service (DoS)

dompdf/dompdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper resource consumption controls during the PDF rendering phase after image dimension validation, which allows an unauthenticated attacker to submit a specially crafted HTML document containing a large...

Improper Validation Of Cookie Domain

Guzzle is vulnerable to Improper Validation of Cookie Domain. The vulnerability is due to improper domain matching for cookies scoped to IP addresses or bare-numeric domains, which allows an attacker to perform cross-host cookie disclosure, cookie injection, or session fixation...

Path Traversal

dompdf/dompdf is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths when processing SVG images embedded through data: URIs, where the second SVG processing pass performed by php-svg-lib does not enforce the same security restrictions, allowing an...

Improper Input Validation

guzzlehttp/psr7 is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of URI host components in Uri::assertValidHost, which fails to reject authority delimiters, embedded ports, and malformed IPv6 brackets, allowing an attacker to craft malicious URIs tha...

File Existence Oracle

dompdf/dompdf is vulnerable to File Existence Oracle. The vulnerability is due to inconsistent handling of the CSS @font-face directive when processing local file:// resources, which allows an attacker to repeatedly reference local files and observe differences in memory exhaustion behavior to...

Server-Side Request Forgery (SSRF)

phpoffice/phpspreadsheet is vulnerable to Server-Side Request Forgery SSRF.The vulnerability is due to improper validation of redirected URLs in the WEBSERVICE formula function, where only the initial URL is checked against the domain whitelist while HTTP redirects are followed without...

Uncontrolled Resource Consumption

phpoffice/phpspreadsheet is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the Gnumeric reader calling gzdecode on attacker-supplied compressed .gnumeric files without enforcing a decompressed-size limit, which allows an attacker to upload a specially crafted...

Denial Of Service (DoS)

pyasn1 is vulnerable to Denial Of Service DoS. The vulnerability is due to the BER decoder parsing long-form tags without limiting the tag identifier size, which allows an attacker to supply crafted ASN.1 input that causes excessive CPU consumption or triggers unhandled exceptions, resulting in a...

Information Disclosure

Open WebUI is vulnerable to sensitive Information Exposure. The vulnerability is due to insufficient authorization on the channel members API, where full user settings are returned to channel participants, allowing authenticated users to access sensitive information such as tool server keys and...

Denial Of Service (DoS)

pypdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of unterminated inline images using the ASCII85 or ASCIIHex filters during PDF parsing, which allows an attacker to craft a malicious PDF that triggers an infinite loop and causes a denial of service...

Cross-site Scripting (XSS)

Mistune is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of the Admonition directive :class: option when rendering HTML, which allows an attacker to inject malicious attributes and execute arbitrary JavaScript in a victim's browser...

Authentication Bypass

LightRAG is vulnerable to Authentication Bypass. The vulnerability is due to the use of a hardcoded default token secret and improper authentication validation order, which allows an unauthenticated attacker to obtain a guest JWT and access protected endpoints without a valid API key...

Denial Of Service (DoS)

pypdf is vulnerable to Denial of Service DoS. The vulnerability is due to improper detection of inline image end markers in PDF page content streams, which allows an attacker to craft a malicious PDF that triggers an infinite loop during parsing and causes a denial of service...

Denial Of Service (DoS)

pypdf is vulnerable to Denial Of Service DoS. The vulnerability is due to inefficient recovery of malformed cross-reference streams in crafted PDF files, which allows an attacker to cause excessive processing time and trigger a denial-of-service condition...

Out-of-Bounds Read

Pillow is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper validation of McIdas AREA image header values that allow an invalid row stride, which allows an attacker to trigger out-of-bounds memory reads leading to information disclosure or application crashes...

Denial Of Service (DoS)

pypdf is vulnerable to Denial Of Service DoS. The vulnerability is due to improper validation of declared image size values during PDF image parsing, which allows an attacker to craft a malicious PDF that triggers excessive memory consumption and causes a denial-of-service condition...

Deserialization Of Untrusted Data

c3p0 is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the use of DataSource and ConnectionPoolDataSource objects that can participate in Java deserialization gadget chains, which allows an attacker to trigger arbitrary code execution when malicious serialized object...

Denial Of Service (DoS)

vLLM is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of prompt embedding payloads for models using M-RoPE, which allows an authenticated attacker to trigger an assertion failure and crash the entire server by sending a crafted /v1/completions request...

Uncontrolled Resource Consumption (Memory Leak)

io.netty, netty-codec-http is vulnerable to Uncontrolled Resource Consumption Memory Leak. The vulnerability is due to the SpdyHttpDecoder failing to release a pooled ByteBuf when processing specific SPDY SYNSTREAM frames that are later reset RSTSTREAM or exceed the configured maxContentLength,...

Uncontrolled Resource Consumption (Denial Of Service)

io.netty, netty-codec-http is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the HttpContentEncoder maintaining an unbounded acceptEncodingQueue that stores attacker-controlled data without any size limit, which allows an attacker to exploit HTTP/1....

Server-Side Request Forgery (SSRF)

org.apache.camel, camel-dns is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of DNS-related Exchange message headers dns.server, dns.name, dns.domain, etc. that can be passed from inbound HTTP requests, which allows an attacker to manipulate DNS...

Information Exposure

org.eclipse.jetty, jetty-server is vulnerable to Information Exposure. The vulnerability is due to improper handling of HTTP/1.1 request trailers, where trailers from a previous request are retained and reused across subsequent requests on the same connection, which allows an attacker to access o...

Improper Handling Of Duplicate Host Headers

io.netty, netty-codec-http2 is vulnerable to Improper Handling of Duplicate Host Headers. The vulnerability is due to the HTTP/2-to-HTTP/1.x translation layer failing to deduplicate or validate Host headers when both the :authority pseudo-header and a literal Host header are present, which allows...

Code Injection

WebAuthn authenticator is vulnerable to Code Injection. The vulnerability is due to an incomplete Java ObjectInputFilter implementation that only validates the root deserialized object while allowing nested objects in the serialization graph to bypass the allowlist, which allows an attacker to...

XML External Entity (XXE) Injection

Netty is vulnerable to XML External Entity XXE Injection. The vulnerability is due to the XmlDecoder using an AsyncXMLInputFactory with default security settings, leaving DTD and external entity processing enabled. This allows an attacker to send specially crafted XML containing a DOCTYPE...

Denial Of Service (DoS)

Netty is vulnerable to Denial of Service DoS. The vulnerability is due to an infinite loop in the run-length encoding RLE state machine within the Bzip2Decoder handler when processing a malformed bzip2 stream, which allows an attacker to exploit the issue by sending a specially crafted bzip2 stre...

HTTP Request Smuggling

io.netty, netty-codec-http is vulnerable to HTTP Request Smuggling. The vulnerability is due to the WebSocket V07/V08 handshaker accepting a WebSocket upgrade request without requiring the Connection: Upgrade and Upgrade: websocket headers, which allows an attacker to force an unrecognized protoc...

Improper Certificate Validation

io.netty, netty-handler-ssl-ocsp is vulnerable to Improper Certificate Validation. The vulnerability is due to OcspClient failing to validate that the CertificateID in an OCSP response matches the requested CertificateID, which allows an attacker to replay a legitimately signed GOOD OCSP response...

Insufficient Session Expiration

code.gitea.io/gitea is vulnerable to Insufficient Session Expiration. The vulnerability is due to improper invalidation of compromised Remember-Me session tokens, which allows an attacker to maintain unauthorized, persistent access to a user's account by reusing a stolen token even after the...

Improper Authentication

Jetty HTTP Client is vulnerable to Improper Authentication. The vulnerability is due to the use of ISO-8859-1 encoding when computing Digest authentication response hashes, which replaces all non-Latin-1 characters with ?, allowing an attacker who knows a victim's username to bypass Digest...

Denial Of Service (DoS)

Immutable.js is vulnerable to Denial Of Service DoS. The vulnerability is due to linear scanning of hash collision buckets in Immutable.Map and Immutable.Set, which allows an attacker to supply many colliding keys and cause excessive CPU consumption during insertion and lookup operations...

Open Redirect

React Router is vulnerable to Open Redirect. The vulnerability is due to improper handling of backslashes in and useNavigate, allowing attackers to bypass redirect validation and redirect users to attacker-controlled websites...

Open Redirect

@astrojs/node is vulnerable to Open Redirect. The vulnerability is due to improper validation of request paths beginning with /\ when trailingSlash: 'always' is enabled, which allows an attacker to craft a URL that redirects users to an external malicious site...

Denial Of Service (DoS)

Next.js is vulnerable to Denial Of Service. The vulnerability is due to insufficient validation of remotely hosted images processed by the Image Optimization API, where malicious image content can trigger excessive CPU consumption, allowing attackers to degrade application availability...

Sensitive Information Disclosure

electron-updater is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of credential-bearing HTTP headers during cross-origin redirects, which allows an attacker to obtain sensitive authentication tokens by redirecting update requests to an...

Server-Side Request Forgery

Next.js is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of request-controlled hostnames in rewrites and redirects rules, where attacker-controlled input can redirect requests to arbitrary hosts, allowing SSRF through rewrites or open redirects...

Denial Of Service

Next.js is vulnerable to Denial Of Service. The vulnerability is due to improper handling of crafted requests targeting applications using the App Router with Server Actions, allowing attackers to trigger excessive CPU usage and block processing of further requests...

Cross-site Scripting (XSS)

n8n is vulnerable to Cross-site Scripting XSS. The vulnerability is due to rendering HTML preview content in an iframe without the sandbox attribute and a sanitizer bypass, which allows an attacker with global member privileges to execute malicious scripts and perform authenticated actions using ...

Denial Of Service (DoS)

LiquidJS is vulnerable to Denial Of Service DoS. The vulnerability is due to the pop array filter allocating a full clone of the input array without enforcing the configured memory limit, which allows an attacker to exhaust memory and cause a denial-of-service condition by rendering templates wit...

Race Condition

n8n is vulnerable to Race Condition. The vulnerability is due to a race condition in the Git node's clone operation that allows an authenticated attacker to replace a validated directory with a symlink, plant a malicious repository as a custom node, and achieve arbitrary code execution when the...