Symlink Privilege Escalation

Apache Storm is vulnerable to symlink privilege escalation. The vulnerability is due to the worker-launcher binary using path‑based lchown and chmod operations after a file‑tree walk with FTS, where an untrusted user can replace an intermediate directory component with a symbolic link between...

CORS Misconfiguration

Apache Storm is vulnerable to CORS misconfiguration. The vulnerability is due to improper handling of CORS headers and JSONP callbacks, where the Logviewer reflects the request's Origin header back in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true, the share...

Denial-of-service (DoS)

React\Http is vulnerable to a denial-of-service DoS. The vulnerability is due to the lack of a size limit on the response-header buffer, which allows a remote attacker to exhaust PHP memory and crash the application by continuously sending HTTP response data without terminating the headers...

Authorization Bypass

Payload CMS is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control and file validation when handling client uploads across multiple collections sharing an S3 bucket, which allows an authenticated attacker to overwrite existing objects belonging to another...

Denial-Of-Service (DoS)

Junrar is vulnerable to denial of service DoS. The vulnerability is due to improper handling of invalid VMJMP instruction targets, which allows an attacker to craft a malicious RAR4 archive that causes infinite CPU consumption and exhausts archive-processing worker capacity during extraction...

Resource Exhaustion

Apache Thrift is vulnerable to resource exhaustion. The vulnerability is due to missing limits or throttling on resource allocation, where the TSaslNonblockingServer can allocate resources without bounds and attackers can trigger unlimited consumption to cause denial of service...

Race Condition

ASP.NET Core is vulnerable to a race condition. The vulnerability is due to concurrent execution using a shared resource with improper synchronization, where a stale asynchronous authorization result in Blazor AuthorizeRouteView can be applied after navigation. which allows an authorized attacker...

Denial-of-service (DoS)

ASP.NET Core is vulnerable to a denial-of-service DoS. The vulnerability is due to the lack of resource limits or throttling, which allows an unauthorized remote attacker to exhaust system resources by sending requests over a network...

Resource Exhaustion

Apache Thrift is vulnerable to Resource Exhaustion. The vulnerability is due to improper handling of exceptional conditions and allocation of resources without limits or throttling, where an uncaught exception in the Java bindings can cause unbounded resource consumption and allow attackers to...

Resource Exhaustion

Apache Thrift is vulnerable to resource exhaustion. The vulnerability is due to unbounded allocation of resources without proper throttling, where the Java bindings perform resource allocation without limits and attackers can trigger excessive resource consumption to cause denial of service...

Information Disclosure

postgresql is vulnerable to information disclosure. The vulnerability is due to uninitialized buffer bytes being used to pad values shorter than their declared length, where SQL statements and parameter values from previous operations on the same connection can be stored in the database and expos...

Authentication Bypass

postgresql is vulnerable to Authentication Bypass. The vulnerability is due to improper handling of the requireAuth connection property when it excludes all supported authentication methods, where the driver then accepts any authentication method the server requests—including cleartext password...

GSS Buffer Leak

pgjdbc the PostgreSQL JDBC Driver is vulnerable to GSS buffer leak. The vulnerability is due to the driver reusing the GSS send buffer when GSS encryption is enabled, where writes from a byte array using methods such as setString, setBytes, ByteStreamWriter, CopyIn.writeToCopy, or LargeObject.wri...

Uncontrolled Resource Consumption

netty-incubator-codec-bhttp is vulnerable to Uncontrolled Resource Consumption . The vulnerability is due to improper termination and lack of forward-progress validation in the BinaryHttpParser field-section decoding loop, which allows an unauthenticated attacker to send a crafted Binary HTTP...

Sensitive Data Leak

Apache Syncope is vulnerable to a sensitive data leak. The vulnerability is due to improper handling of AES keys with non‑standard lengths, where the padded key value is logged and attackers can read the logs to obtain the secret key...

Path Traversal

@makafeli/n8n-workflow-builder is vulnerable to path traversal. The vulnerability is due to improper validation of the filePath argument in the updatenodefromfile function in build/server.cjs, which allows a local attacker to manipulate file paths to access files outside the intended directory...

Improper Input Validation

Bouncy Castle for Java is vulnerable to Improper Input Validation. The vulnerability is due to the MTI/A0 Diffie-Hellman agreement process exponentiating unvalidated peer-supplied values without range or subgroup-membership checks, which allows a malicious peer to recover the local static private...

Resource Exhaustion

code.vikunja.io/api is vulnerable to a resource exhaustion. The vulnerability is due to the lack of recursion depth limits for deeply nested filter expressions in the task-filter endpoint, which allows an authenticated attacker to submit thousands of nested parentheses in the filter query...

Authentication Bypass

code.vikunja.io/api is vulnerable to an authentication bypass. The vulnerability is due to the emailfallback option linking an SSO login to an existing local account without verifying the email claim or requiring the account password, which allows an attacker with a token containing the victim’s...

Resource Exhaustion

code.vikunja.io/api is vulnerable to a resource exhaustion. The vulnerability is due to the Planka migrator failing to enforce aggregate memory limits during migration jobs, which allows an authenticated attacker to exhaust worker memory by submitting migration requests to attacker-controlled...

Denial Of Service (DoS)

code.vikunja.io/api is vulnerable to a denial-of-service. The vulnerability is due to the failure to limit archive expansion during data import, which allows an authenticated attacker to upload highly compressed files that expand to tens of gigabytes in memory and on disk, exhaust server resource...

Sensitive Information Exposure

code.vikunja.io/api is vulnerable to sensitive information exposure. The vulnerability is due to insufficient protection of password-reset, email-confirmation, and account-deletion tokens, which allows an attacker with database read access to use pending tokens to take over user accounts without...

Improper Access Control

code.vikunja.io/api is vulnerable to improper access control. The vulnerability is due to insufficient access restrictions on the link-share hash field in single-share read endpoints, which allows an attacker with read-only access to obtain the secret credential, generate a link-share JWT, and...

Resource Exhaustion

code.vikunja.io/api is vulnerable to a resource exhaustion. The vulnerability is due to the failure to limit the number of parsed CSV rows in the /api/v2/migration/csv/migrate endpoint, which allows an authenticated attacker to upload a CSV file containing millions of small records, exhaust proce...

Rate-Limiting Bypass

code.vikunja.io/api is vulnerable to a rate-limiting bypass. The vulnerability is due to missing rate limits on login, registration, password-reset, and OAuth token endpoints, which allows remote unauthenticated attackers to perform unlimited credential guessing, enumerate user accounts, and floo...

Denial Of Service (DoS)

github.com/jhaals/yopass is vulnerable to denial of service DoS. The vulnerability is due to the use of attacker-controlled HTTP method values as metric labels without validation, which allows an unauthenticated remote attacker to create numerous unique metric series, causing excessive memory...

Denial-of-service (DoS)

code.vikunja.io/api is vulnerable to a denial-of-service DoS. The vulnerability is due to missing pixel count restrictions on avatar and project-background uploads, which allows an authenticated attacker to upload crafted images with extreme aspect ratios that consume excessive CPU and memory,...

Denial-of-service (DoS)

github.com/luskaner/agelanserver/server is vulnerable to a denial-of-service DoS. The vulnerability is due to the lack of request body size limits and validation of the attacker-controlled JSON array length, which allows a remote unauthenticated attacker to trigger excessive memory allocation by...

Principal-Type Confusion

code.vikunja.io/api is vulnerable to a principal-type confusion. The vulnerability is due to missing type validation in permission checks, which allows an attacker with a link-sharing JWT to exploit ID collisions to remove victims from teams, enumerate and delete their bot users, or access team...

Arbitrary File Access

Docling is vulnerable to arbitrary file read and write. The vulnerability is due to the Tectonic engine compiling untrusted TikZ input without restricting file access, which allows an attacker to read accessible files and create or overwrite writable files, with potential command execution if she...

Use-after-free

The zstd-jni library is vulnerable to a use-after-free. The vulnerability is due to improper memory management during dictionary loading, which allows a remote attacker to potentially exploit the freed memory and compromise application stability or security...

Missing Authorization

Hazelcast is vulnerable to Missing Authorization. The vulnerability is due to missing authorization checks in the IMap Predicates API, which allows a malicious client with limited privileges to execute arbitrary code on a Hazelcast cluster member...

Improper Input Validation

Hazelcast is vulnerable to Improper Input Validation. The vulnerability is due to improper validation of data supplied by a malicious client connected to the cluster, which allows an attacker to read arbitrary memory from a cluster member, crash the member, or potentially corrupt memory and execu...

Sensitive Information Disclosure

Docling is vulnerable to sensitive information disclosure. The vulnerability is due to the HTML image resource loader forwarding configured headers to remote image URLs without restricting them to the source document’s origin, which allows an attacker to expose configured credentials, such as API...

Denial Of Service (DoS)

com.rabbitmq:amqp-client is vulnerable to Denial-of-service DoS. The vulnerability is due to the JSONReader.read method failing to terminate when parsing truncated strings or unterminated line comments, which allows an attacker to exhaust heap memory or consume excessive CPU resources through...

Cross-Site Scripting (XSS)

Ghost is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to imported SVG images being stored without sanitization, which allows an attacker to convince an Administrator to import a crafted file and host malicious scripts on the site's domain, potentially compromising staff users'...

Denial Of Service (DoS)

svg-sanitizer is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of DTD-defined FIXED attribute defaults during repeated attribute removal in cleanAttributesOnWhitelist, which allows an attacker to submit a crafted SVG that corrupts libxml state and terminates P...

Denial Of Service (DoS)

svg-sanitizer is vulnerable to Denial Of Service DoS. The vulnerability is due to case-sensitive href attribute validation in Resolver::processReferences before mixed-case attributes are normalized, which allows an attacker to bypass the useNestingLimit protection with crafted nested SVG elements...

Cross-site Scripting (XSS)

savg-sanitizer is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to inconsistent handling of XML entity references during SVG URL validation and serialization, which allows an attacker to bypass sanitization with a crafted SVG containing a javascript: URL and execute malicious...

Arbitrary Code Execution (ACE)

hydraoptunasweeper is vulnerable to arbitrary code execution. The vulnerability is due to improper validation of configuration-controlled dotted paths in hydra-optuna-sweeper, which allows an attacker to execute arbitrary importable Python code with the application's privileges by manipulating...

Improper Authorization

Langflow is vulnerable to improper authorization. The vulnerability is due to insufficient validation of resource URIs and failure to verify flow ownership in project-scoped MCP connections, which allows an attacker with access to an MCP endpoint to read other users’ private flow files, including...

Improper Input Validation

AsyncHttpClient is vulnerable to Improper Input Validation. The vulnerability is due to failure to reject public suffixes in cookie Domain attributes, which allows an attacker controlling a host beneath a public suffix to inject or overwrite cookies shared across unrelated hosts, potentially...

Cleartext Transmission Of Sensitive Information

AsyncHttpClient is vulnerable to Cleartext Transmission of Sensitive Information. The vulnerability is due to improper handling of cross-host request replay, which allows an attacker to trigger documented retry or failover paths that send the original host's request data, authorization credential...

Insecure Temporary File Handling

lz4-java is vulnerable to Insecure Temporary File Handling. The vulnerability is due to the way net.jpountz.util.Native.load extracts the native library: it creates a lock file with File.createTempFile and then derives the library path by stripping the .lck suffix, opening the resulting file with...

Authentication Downgrade

AsyncHttpClient is vulnerable to Authentication Downgrade. The vulnerability is due to improper handling of Digest authentication challenges with missing or empty nonces, which allows a malicious origin or proxy to downgrade authentication to Basic and obtain the user's username and password in a...

Server-Side Template Injection

Handlebars is vulnerable to Server-Side Template Injection SSTI. The vulnerability is due to improper enforcement of prototype-access restrictions in lookupProperty, which allows an attacker to bypass the deny list, access the Function constructor through a controlled template, and execute...

Use After Free

zstd-jni is vulnerable to Use-After-Free. The vulnerability is due to streams and contexts releasing a dictionary's shared lock after the load operation while retaining references to the dictionary, which allows an attacker to close the dictionary and cause subsequent operations to access freed...

Out-of-Bounds Read

zstd-jni is vulnerable to Out-of-Bounds Read. The vulnerability is due to failure to validate the samples buffer capacity in Zstd.trainFromBufferDirect, which allows an attacker to supply oversized sample lengths that cause the native implementation to read beyond buffer boundaries, potentially...

Out-of-Bounds Read

zstd-jni is vulnerable to Out-of-Bounds Read. The vulnerability is due to improper 32-bit signed bounds checking of direct-ByteBuffer frame-size native methods, which allows an attacker to provide negative or overflowing offsets to read unintended memory locations, potentially causing JVM...

Out-of-bounds Memory Read

zstd-jni is vulnerable to an out-of-bounds memory read. The vulnerability is due to insufficient validation of untrusted offset and length values, which allows an attacker to read data from the native heap into the compression dictionary, potentially causing JVM crashes...