Server-Side Request Forgery (SSRF)

kLOsk adloop is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of the finalurl parameter in the validateurls function, where attacker-controlled URLs are processed without adequate restrictions, allowing attackers to make server-side requests t...

Uncontrolled Resource Consumption

github.com/stackloklabs/mkp is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the server accepting unbounded limitBytes and tailLines values and reading the entire Kubernetes pod log stream into memory without enforcing a size limit, which allows an...

Uncontrolled Resource Consumption

github.com/spectolabs/hoverfly is vulnerable to Uncontrolled Resource Consumption Denial of Service. The vulnerability is due to the use of http.DefaultClient without a configured timeout for remote post-serve actions, which allows an attacker to trigger requests to a non-responsive endpoint,...

Improper Authorization

FlaskBB is vulnerable to Improper Authorization. The vulnerability is due to a type mismatch in the bulk group deletion protection check, where integer group IDs are incorrectly compared against string values, allowing authenticated administrators to delete built-in authorization groups and...

Concurrent Execution Using Shared Resource

github.com/spectolabs/hoverfly is vulnerable to Concurrent Execution using Shared Resource. The vulnerability is due to the AddDiff function writing to the shared responsesDiff map without proper synchronization when running in Diff mode, which allows an attacker to send multiple simultaneous...

DNS Rebinding

9Router is vulnerable to DNS Rebinding. The vulnerability is due to inconsistent DNS validation during image fetching, where the image URL is validated and fetched using separate DNS resolutions, allowing attackers to exploit DNS rebinding to access internal HTTP services...

Authentication Bypass

9Router is vulnerable to Authentication Bypass. The vulnerability is due to improper trust of loopback requests, where requests forwarded through 127.0.0.1 are incorrectly treated as local and exempt from API key authentication, allowing unauthenticated attackers to access protected /v1 APIs and...

Path Traversal

github.com/k3s-io/k3s is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths in the etcd snapshot decompression functionality when restoring compressed ZIP-based snapshots, which allows an attacker to craft archive entries with malicious file names that wri...

Path Traversal

SiYuan is vulnerable to Path Traversal. The vulnerability is due to improper validation of double URL-encoded path traversal sequences in the /assets/path route, where attackers can bypass path restrictions to read arbitrary files within the workspace directory, exposing sensitive configuration...

Improper Access Control

OpenCost is vulnerable to Improper Access Control. The vulnerability is due to missing authentication in the /serviceKey endpoint, which allows an attacker to overwrite the GCP service account key file remotely, leading to service disruption, credential theft, and potential privilege escalation...

Remote Code Execution (RCE)

DIRAC RequestManager is vulnerable to remote code execution.The vulnerability is due to the use of eval on untrusted input, which allows an authenticated attacker to execute arbitrary code or system commands on the DIRAC server with the privileges of the user running the DIRAC services...

Path Traversal

py-rattler are vulnerable to Path Traversal. The vulnerability is due to improper validation of the package record build string used to construct cache file paths during package cache materialization, which allows an attacker controlling a malicious or untrusted conda channel to inject path...

Improper Authentication

PraisonAI AgentMail is vulnerable to Improper Authentication. The vulnerability is due to missing signature verification for webhook requests, where crafted message.received events are accepted without validating their authenticity, allowing unauthenticated attackers to inject spoofed messages an...

API Key Bypass

9Router is vulnerable to API key bypass. The vulnerability is due to the router determining whether a /v1 LLM proxy request is local by reading the client-controlled Host header, where a remote unauthenticated attacker can send Host: localhost and bypass API-key authentication, and this allows th...

Authentication Bypass

9Router is vulnerable to Authentication Bypass. The vulnerability is due to missing authentication checks for the /codex endpoint, where requests bypass the API key validation before being rewritten to protected API routes, allowing unauthenticated attackers to invoke upstream LLM provider APIs...

JWT Expiration Bypass

ZITADEL is vulnerable to JWT expiration bypass. The vulnerability is due to the external JWT Identity Provider validation skipping expiration handling when an incoming token omits the exp claim, where a token from a trusted issuer can be treated as valid without an automatic expiration window, an...

Improper Authorization

github.com/zitadel/zitadel is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation during OAuth2 token exchange, where the endpoint does not verify token ownership or restrict requested scopes to those of the original token, allowing attackers to exchange...

Arbitrary Command Execution

GitHub CLI is vulnerable to Arbitrary Command Execution. The vulnerability is due to insufficient validation of JupyterLab URLs returned by a Codespace, where attacker-controlled non-loopback URLs such as vscode:// are passed to VS Code, allowing malicious Codespaces to execute arbitrary commands...

Path Traversal

decompress is vulnerable to Path Traversal. The vulnerability is due to an improper path containment check during archive extraction, where path validation fails to enforce directory boundaries, allowing attackers to bypass extraction restrictions and write arbitrary files outside the intended...

Prototype Pollution

apidevtools json-schema-ref-parser is vulnerable to Prototype Pollution. The vulnerability is due to improper validation of property names in the Refs.set and Pointer.set functions, where attacker-controlled input can modify object prototype attributes, allowing attackers to manipulate applicatio...

Denial Of Service

HashiCorp memberlist is vulnerable to Denial Of Service. The vulnerability is due to improper handling of push/pull state messages, where specially crafted gossip traffic can exhaust memory on a receiving node, allowing attackers with network access to terminate the process...

Uncontrolled Resource Consumption (Infinite Loop)

pypdf is vulnerable to Uncontrolled Resource Consumption Infinite Loop. The vulnerability is due to improper handling of crafted PDF files containing threads/articles during the merge operation, which allows an attacker to trigger an infinite loop by supplying a malicious PDF, resulting in a...

Out-of-Bounds Write

pymonocypher is vulnerable to Out-of-Bounds Write. The vulnerability is due to the argon2i32 implementation failing to validate the nbblocks buffer size before writing, which allows an attacker to trigger a write past the end of the provided buffer, potentially causing heap corruption and resulti...

Command Injection

langroid is vulnerable to Command Injection. The vulnerability is due to the Neo4jChatAgent executing LLM-generated Cypher queries without validation, statement-type restrictions, or an opt-out mechanism, which allows an attacker to exploit prompt injection to execute arbitrary Cypher queries,...

SQL Injection

langroid is vulnerable to SQL Injection. The vulnerability is due to insufficient SQL injection mitigation in the SQLChatAgent, where PostgreSQL function calls can bypass the regex-based blocklist using quoted identifiers, inline comments, or schema qualification, which allows an attacker to...

Path Traversal

psd-tools is vulnerable to Path Traversal. The vulnerability is due to improper validation and sanitization of attacker-controlled file paths in the SmartObject.save and SmartObject.open APIs, which allows an attacker to write arbitrary files to attacker-chosen locations outside the intended...

Deserialization Of Untrusted Data

org.openidentityplatform.opendj:opendj-server-legacy is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to the JMX RMI connector processing attacker-controlled serialized data before authentication, which allows an unauthenticated attacker to deserialize arbitrary Java...

Remote Code Execution (RCE)

Joro is vulnerable to Remote Code Execution RCE. The vulnerability is due to the default proxy mode exposing an unauthenticated local API with a wildcard CORS policy, which allows an attacker to use cross-origin JavaScript to upload a malicious native plugin and trigger a restart...

OS Command Injection

Nuclio is vulnerable to OS Command Injection. The vulnerability is due to improper sanitization of event.headers keys and event.body values when constructing curl commands for Kubernetes CronJob containers, which allows an attacker to inject and execute arbitrary shell commands by manipulating...

OS Command Injection

File Browser is vulnerable to OS Command Injection. The vulnerability is due to the Hook Authentication feature interpolating user-supplied username and password into an external shell command without proper sanitization, which allows an unauthenticated remote attacker to inject shell...

Missing Authentication

SiYuan is vulnerable to Missing Authentication. The vulnerability is due to the kernel HTTP server unconditionally trusting all chrome-extension:// origins without authentication and the default empty AccessAuthCode on desktop installations, which allows an attacker controlling a malicious or...

OS Command Injection

9router is vulnerable to OS Command Injection. The vulnerability is due to improper handling of the sudoPassword parameter in the unauthenticated POST /api/tunnel/tailscale-install endpoint, which is passed to a sudo -S sh process without authorization checks, allowing a remote unauthenticated...

Server-Side Request Forgery (SSRF)

@better-auth/sso is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of attacker-controlled oidcConfig.userInfoEndpoint, tokenEndpoint, and jwksEndpoint URLs when skipDiscovery: true is enabled, which allows an authenticated attacker to persist...

Cross-site Scripting (XSS)

Craft CMS is vulnerable to Stored cross-site scripting XSS. The vulnerability is due to improper escaping of entry titles during drag-and-drop operations, where user-controlled titles are decoded and inserted into HTML without proper sanitization, allowing attackers to execute arbitrary JavaScrip...

Remote Code Execution

Craft CMS is vulnerable to remote code execution RCE. The vulnerability is due to unsafe rendering of user-controlled data as an unsandboxed Twig template, where the Referer HTTP header is compiled without sandboxing during entry saves, allowing authenticated attackers to execute arbitrary code o...

Cross-Site Request Forgery (CSRF)

Leantime is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to missing validation of the OIDC state parameter in the verifyState method, where attacker-controlled authorization callbacks are accepted without verification, allowing attackers to perform session fixation and...

Improper Authorization

Leantime is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks in the Users::getUser JSON-RPC API, where authenticated users can retrieve sensitive credential data for arbitrary user accounts, allowing attackers to obtain password hashes, TOTP secrets,...

Improper Certificate Validation

Coder is vulnerable to Improper Certificate Validation. The vulnerability is due to the AI Bridge Proxy aibridgeproxyd creating a default HTTPS transport with InsecureSkipVerify enabled when no upstream proxy is configured, which allows an on-path man-in-the-middle attacker to present a forged TL...

Improper Input Validation

github.com/coder/coder is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of the scheme and host in external workspace application URLs before substituting the $SESSIONTOKEN placeholder, which allows an attacker controlling a malicious workspace templa...

Improper Access Control

Coder is vulnerable to Improper Access Control. The vulnerability is due to the tailnet coordinator validating an agent's Addresses but not its AllowedIPs, which allows an authenticated attacker to advertise unauthorized IP prefixes that are propagated to WireGuard peers, potentially enabling...

Stored Cross Site Scripting

showdown is vulnerable to stored cross-site scripting. The vulnerability is due to a failure to properly escape table header ID attributes in the parseHeaders function, where attackers can inject arbitrary HTML and script-executing SVG elements through double-quote characters in markdown table...

Sensitive Information Exposure

Apache Camel Undertow Component is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper handling of exception responses, where processing errors return full Java stack traces instead of suppressing them, allowing attackers to obtain sensitive information such as...

Improper Authorization

github.com/coder/coder is vulnerable to Improper Authorization. The vulnerability is due to insufficient validation in the UpsertWorkspaceApp and insertAgentApp functions, which fail to verify that a supplied application ID belongs to the workspace being built before performing a cross-workspace...

Improper Authentication

Apache Camel is vulnerable to Improper Authentication. The vulnerability is due to missing authentication for critical functions, where the KeycloakSecurityPolicy defaults to not verifying the access token, and an invalid token is accepted, allowing unauthenticated access to protected routes...

SSH Configuration Injection

Coder is vulnerable to SSH Configuration Injection. The vulnerability is due to coder config-ssh writing server-supplied HostnameSuffix and SSHConfigOptions into the user's /.ssh/config without properly sanitizing embedded newlines or restricting SSH directives, which allows an attacker controlli...

Improper Authorization

Craft CMS is vulnerable to Improper Authorization. The vulnerability is due to insufficient authorization checks after author reassignment in EntriesController::actionSaveEntry, where attacker-controlled author parameters are applied without revalidating permissions, allowing low-privileged users...

Improper Privilege Management

github.com/coder/coder is vulnerable to Improper Privilege Management. The vulnerability is due to insufficient authorization checks in the PUT /api/v2/users/user/password endpoint, which allows a privileged user-admin attacker to reset the password of an owner account without requiring the curre...

Improper Authentication

github.com/coder/coder is vulnerable to Improper Authentication. The vulnerability is due to improper OIDC email-based account linking and incorrect handling of the emailverified claim, which allows an attacker to authenticate with a malicious or unverified OIDC identity and take over another...

Arbitrary Code Injection

Langroid is vulnerable to Arbitrary Code Injection. The vulnerability is due to improper sandboxing of Python eval that fails to remove builtins, which allows an attacker to execute arbitrary operating system commands through crafted LLM-generated tool messages...

Improper Authorization

The CreateSubAgent RPC is vulnerable to improper authorization. The vulnerability is due to the failure to validate the requested app sharing level against the template's maximum allowed sharing level before persisting workspace apps, which allows a workspace owner to exceed the...