CVE Catalog

A null pointer dereference vulnerability has been identified in the EXIF decoder of libvips, a fast image processing library, in versions prior to and including 8.18.1. The vulnerability arises because the decoder did not properly validate the range of EXIF tag groups before sending the data to libexif, potentially leading to a crash.

A protocol-semantics vulnerability has been identified in NanoMQ's MQTT v5 SUBSCRIBE handling, specifically in versions through 0.24.x. The issue arises when a subscription entry omits the final 1-byte Subscription Options field. In such cases, the broker may still accept the malformed packet and incorporate the subscription into its internal state. This flaw can be exploited to create a 1-byte out-of-bounds read that crosses the actual heap allocation boundary, resulting in a heap-buffer-overflow error detected by AddressSanitizer (ASAN). The vulnerability manifests as a semantic acceptance of malformed SUBSCRIBE packets, which should have been rejected according to MQTT rules, and under certain conditions, it leads to a verifiable memory-safety violation.

A critical remote code execution vulnerability has been identified in the Piwigo installer, specifically in versions through 16.3.0. The issue arises because the installer accepts POST parameters for database configuration and writes them directly into a PHP configuration file without adequate sanitization. In PHP 8 and later, the `addslashes()` function, which could have provided some level of protection, is rendered ineffective as it relies on `get_magic_quotes_gpc()`, a function that was removed in PHP 8.0. This flaw allows raw user input to be directly interpolated into PHP code. An unauthenticated attacker can exploit this by injecting arbitrary PHP code through several POST parameters, including prefix, dbpasswd, dbhost, dbname, and dbuser. The injected code is written to `local/config/database.inc.php`, where it is executed with web server privileges on every page load.

A vulnerability in libvips versions through 8.18.0 on 32-bit systems allows the 'gifload' operation to miscalculate image dimensions, resulting in an integer overflow. This issue has been addressed in version 8.18.1.

A heap-based buffer overflow vulnerability has been identified in libvips versions through 8.18.0. The issue arises in the 'vipsload' operation, where incorrect determination of image dimensions can lead to an integer overflow, allowing for a buffer overflow on the heap.

A vulnerability exists in dataCycle-CORE versions prior to 25.07.3, where the application allows unlimited password attempts on both the web login interface and the JSON login API. This issue arises because the user model's Devise ':lockable' module is enabled, but the lock and unlock strategies are disabled, leaving no request throttling or rate-limiting. As a result, valid user accounts can be targeted continuously without temporary lockout. The vulnerability is present on the '/users/sign_in' and '/api/v4/auth/login' endpoints. Successful password guessing provides a standard session cookie in the web application or a new JWT in the API, which is particularly susceptible to automation since it does not require a CSRF token.

A vulnerability exists in dataCycle-CORE versions prior to 25.07.3, allowing low-privileged authenticated API users to manipulate `forwardToUrl` and `redirectUrl` values during password reset or confirmation processes. These values are sent in the outgoing emails without any host allowlisting. This vulnerability creates two related abuse paths: first, an attacker can send a victim a password reset or confirmation link with a token attached, directing them to an attacker-controlled `forwardToUrl`; second, after a legitimate password reset, the victim's browser is redirected to an attacker-controlled `redirectUrl`. This could be exploited for phishing, token capture, confirmation hijacking, or redirecting a victim from a trusted email to an attacker-controlled domain.

A vulnerability in dataCycle-CORE versions prior to 25.07.3 allows for server-side request forgery (SSRF) by exploiting state-changing GET endpoints. The application fails to apply proper Cross-Site Request Forgery (CSRF) protections to GET requests, enabling attackers to manipulate application state on behalf of logged-in users. This can be achieved by embedding a link or redirecting to a vulnerable endpoint, such as 'watch_lists/:id/add_item?thing_id=...', which adds items to a watch list without requiring a CSRF token. Other GET mutation routes are also available, including user impersonation for authorized admins and changes to cache or translation states.

A vulnerability exists in dataCycle-CORE versions prior to 25.07.3, allowing authenticated API users to impersonate other users and access their collections. This is achieved by supplying a target user's email to the collection API, which can then expose those collections if they exist. Furthermore, in version 4, once a collection ID is obtained, the same API controller provides routes to add or remove items from the collection without proper authorization checks, potentially allowing cross-user modifications.

A path traversal vulnerability has been identified in dataCycle-CORE versions prior to 25.07.3. The issue arises in the module responsible for core processing and framework rules, where the documentation and static markdown renderer improperly handle attacker-controlled path segments. These segments are only sanitized using the Rails HTML sanitizer, which fails to remove directory traversal sequences. As a result, an unauthenticated attacker can escape the designated 'docs' or 'static' directories and access arbitrary '.md' files from either the application root or engine root.

A user directory enumeration vulnerability has been identified in dataCycle-CORE versions prior to 25.07.3. In the core processing module, standard users can exploit the `/users/search` endpoint to retrieve the names and email addresses of other users. This occurs despite restrictions preventing direct access to those user profiles. As a result, internal staff email addresses, full names, and the existence of guest and external test accounts are inadvertently exposed.

An authorization bypass vulnerability has been identified in dataCycle-CORE versions prior to 26.06.11. The issue allows any authenticated user to request arbitrary partials or helper-backed render functions through the /remote_render endpoint. This endpoint lacks restrictions on which partials can be rendered and does not enforce controller-specific authorization before rendering the selected view. As a result, low-privileged users can access server-side rendered admin content that is typically concealed by navigation and route checks. For instance, a Standard user was able to obtain PostgreSQL admin dashboard statistics, even though the /admin route redirected away from that content.

A stored cross-site scripting vulnerability has been identified in Q-smart NexT Poll by Bifra Engineering Consulting Ltd. This issue arises from improper input neutralization during web page generation, allowing attackers to inject malicious scripts that are saved and executed later. The vulnerability affects Q-smart NexT Poll versions prior to 1.8.7.

A critical vulnerability in HeyForm's file upload feature allows any anonymous user to upload files without authentication or proper validation. The issue exists in versions through 3.0.0-rc.8. The /api/upload endpoint lacks authentication guards, session checks, and form-context validation, enabling unrestricted file uploads of various types, including documents, images, and videos, up to 10 MB. Uploaded files receive a permanent public URL on the HeyForm domain, which can be exploited to distribute malicious content or phishing attacks.

A vulnerability exists in HeyForm, an open-source form builder, in versions prior to 3.0.0-rc.9. The issue arises in the `completeSubmission` mutation, which accepts a `hiddenFields` array from the submitter. This array is stored verbatim in the submission data without validating the `id` or `name` against the form's schema. As a result, an anonymous submitter can inject arbitrary key/value pairs, including XSS payloads, fake authorization data, and other integration-relevant values. These injected fields are then forwarded as-is to every webhook integration associated with the form.

A privilege escalation vulnerability exists in rConfig Core versions prior to 8.2.8. This vulnerability allows authenticated users to assign arbitrary roles to any account by submitting an unvalidated role field through the Users API during user creation or profile updates. The absence of proper allowlist validation and admin-level authorization checks in the StoreUserRequest component enables attackers to mass-assign the Admin role, granting access to privileged features. rConfig Pro and Enterprise versions are not affected.

A path traversal vulnerability has been identified in FileThingie version 2.5.7, allowing remote attackers to manipulate file paths and write sensitive information to arbitrary locations on the server. The issue arises in the 'ft2.php' component, where inadequate validation of directory traversal sequences ('../') enables exploitation.

A directory traversal vulnerability has been identified in FileThingie version 2.5.7. This vulnerability allows authenticated remote attackers to read arbitrary files on the server by exploiting improper input sanitization. The issue arises when the application attempts to clean user input in the `$_REQUEST` superglobal but fails to adequately sanitize the `$_GET` superglobal, which is ultimately used in file handling operations. As a result, attackers can craft requests that bypass the sanitization process and access sensitive files through the file download functionality.

A denial-of-service vulnerability has been identified in Mailpit, an email testing tool for developers, in versions prior to 1.30.1. The issue arises in four JSON-body API endpoints: 'PUT /api/v1/messages', 'DELETE /api/v1/messages', 'PUT /api/v1/tags', and 'POST /api/v1/message/{id}/release'. These endpoints, which remain unauthenticated in the default Docker deployment, allow remote attackers to send large payloads that exhaust server memory. This vulnerability was introduced because the endpoints do not have a body-size limit, unlike the 'POST /api/v1/send' endpoint, which was properly capped. As a result, an attacker can drive the server's resident set size (RSS) from a baseline of approximately 25 MiB to around 450 MiB per 16 MB request, with the memory exhaustion compounding across multiple connections.

A path traversal vulnerability has been identified in the Rust OneNote File Parser, specifically in versions prior to 1.1.1. The issue arises when the parser processes a maliciously crafted '.onetoc2' table-of-contents file. The vulnerability allows the parser to access arbitrary files on the host filesystem, outside the notebook's directory. This occurs because the parser does not properly validate entry names in the '.onetoc2' file, allowing for exploitation by joining these names with the notebook's base directory and potentially accessing sensitive files.

A vulnerability exists in the lettre mailer library for Rust, specifically in versions 0.10.1 prior to 0.11.22, when the 'boring-tls' feature is enabled. An inverted-boolean bug in the TLS integration disables hostname verification for users relying on the default strict configuration. This flaw allows an on-path attacker to intercept SMTP submissions, including PLAIN/LOGIN credentials and message contents, by presenting any chain-valid certificate for any domain. Other TLS backends, such as 'native-tls' and 'rustls', are not affected.

A vulnerability in the Caddy Defender plugin prior to version 0.10.1 allows requests from blocked IP ranges to bypass defense mechanisms when Caddy is behind a trusted proxy, CDN, or load balancer. The issue arises because Defender relied on 'r.RemoteAddr', which only reflects the immediate connection peer—typically the proxy—rather than the original client. Although Caddy can resolve the true client IP after applying the 'trusted_proxies' policy, Defender did not utilize this information. Consequently, in affected deployments, clients could circumvent IP blocking by accessing Caddy through an unblocked proxy.

A supply chain vulnerability has been identified in the @beproduct/nestjs-auth package, specifically in versions 0.1.2 through 0.1.19. During a brief window on May 11, 2026, an attacker exploited a compromised npm publish token to release 18 malicious versions of the package. These versions included a postinstall payload designed to steal various credentials and secrets from the user's environment, such as npm tokens, GitHub personal access tokens, AWS credentials, and HashiCorp Vault tokens. The stolen information was exfiltrated to an external server, and the malicious code also established persistence by writing files into the developer's working directory. The vulnerability has been linked to the 'Mini Shai-Hulud' npm worm campaign, which targeted other packages in addition to @beproduct/nestjs-auth.

A stored cross-site scripting vulnerability has been identified in HeyForm, an open-source form builder, prior to version 3.0.0-rc.7. The issue arises from the '/api/upload' endpoint, which allows unauthenticated file uploads, including SVG files. These uploaded SVGs are stored in the static assets directory and served with 'Content-Type: image/svg+xml' by Express's serve-static middleware. This misconfiguration enables an attacker to execute embedded JavaScript on the HeyForm domain without any authentication.

A denial-of-service vulnerability has been identified in Mailpit, an email testing tool for developers. Prior to version 1.30.0, the SMTP server and the HTTP /api/v1/send endpoint allowed unlimited message sizes, leading to excessive memory and disk usage. This flaw arises because the maximum size limit for incoming data is not properly set, leaving it at the default value of zero, which indicates no restriction. As a result, an attacker can exploit this vulnerability by sending large messages, causing the Mailpit process to consume excessive RAM and eventually crash. The issue is exacerbated by the fact that Mailpit's default settings require no authentication and expose the SMTP and HTTP services to the network.

A denial-of-service vulnerability has been identified in Mailpit, an email testing tool for developers, in versions prior to 1.30.0. The issue arises in the screenshot/print proxy, which manages a cache of message assets. The proxy reads this cache without proper synchronization, allowing concurrent writes from a cleanup routine and CSS-rewriting process to cause a fatal runtime error. This unsynchronized access can be exploited by sending concurrent requests to the proxy, leading to a crash that terminates the Mailpit process and disrupts its SMTP, POP3, and HTTP services.

A path traversal vulnerability allowing arbitrary file writes has been identified in Mailpit versions prior to 1.30.0. The issue arises in the 'mailpit dump --http <base-url> <out-dir>' sub-command, which downloads messages from a remote Mailpit instance and saves them as .eml files in a user-specified directory. The vulnerability is exploited by a malicious HTTP server that impersonates Mailpit, manipulating the message ID to traverse directories and write files to locations outside the intended output directory. This could overwrite sensitive files such as cron jobs or CI artifacts, and potentially execute code if the written file is executed as a script.

A server-side request forgery (SSRF) vulnerability has been identified in Mailpit, an email testing tool for developers. This issue arises in versions 1.28.3 and later, prior to 1.30.0, specifically within the HTML Check API. The vulnerability allows the server to make HTTP requests to internal loopback, private, link-local, and reserved/multicast IP ranges, bypassing security measures that are supposed to block such access. The flaw can be exploited by sending an HTML email that includes a link to an external CSS file controlled by the attacker. When the email is processed, Mailpit follows the link, potentially redirecting the request to a private network resource without detection.

A stored cross-site scripting vulnerability has been identified in HeyForm, an open-source form builder, prior to version 3.0.0-rc.7. This vulnerability allows a low-privileged team member to inject malicious JavaScript into form field titles. The injected script executes when a team owner views the form, potentially leading to a complete account takeover by transferring team ownership to the attacker.

A reflected DOM cross-site scripting vulnerability has been identified in dataCycle-CORE versions prior to 25.07.3. The issue arises in the core processing module, where an unauthenticated attacker can inject arbitrary HTML into flash notifications on public routes. This injected content is then rendered in the DOM using 'innerHTML', allowing the execution of malicious scripts. The vulnerability can be exploited by sending a crafted link to a public page, such as '/docs', as the affected JavaScript is loaded in the standard application layout, not restricted to admin views or debug pages.

A vulnerability in dataCycle-CORE versions prior to 25.07.3 allows unauthorized access to attached text files via DataLink UUIDs. The issue arises because the public route does not validate link expiration or authentication, enabling anyone with a UUID to download files even through expired or previously logged email links. This flaw is exacerbated by the mailer embedding direct file URLs, which can be leaked or forwarded.

A vulnerability in Wazuh's Cluster Distributed API (DAPI) prior to version 4.14.5 allows authenticated cluster peers to exploit unsafe deserialization of JSON objects. The master node can be manipulated to execute attacker-controlled functions within a compromised Role-Based Access Control (RBAC) context. This exploitation enables unauthorized administrative actions, such as arbitrary file modifications, creation of API users, and alterations to the security configuration, potentially leading to a complete compromise of the Wazuh manager.

A remote code execution vulnerability has been identified in EGroupware versions through 26.2.20260216 and 23.1.20260131. This vulnerability allows authenticated attackers to execute arbitrary commands on the server. If user self-registration is enabled, the vulnerability may be exploitable without prior authentication. The issue arises from improper authorization checks, combined with a file write primitive and an arbitrary file read vulnerability, enabling full system compromise.

A buffer underflow vulnerability has been identified in the HDF5 library, specifically in versions through 1.14.6. The issue arises in the H5Iget_name function when it is called with a group ID and a size parameter of zero. This leads to an underflow as the function attempts to write a null terminator into the buffer. The vulnerability can be exploited if the size parameter is manipulated to zero, and there is sensitive data preceding the name buffer.

A vulnerability in HDF5 versions 2.0.0 prior to 2.1.0 allows for out-of-bounds read operations triggered by corrupted array datatype metadata. The issue arises when the full size of the datatype, the number of elements, and the element size are inconsistent, leading to misaligned data interpretations. This vulnerability is only present in files that have been maliciously altered, as normal usage does not typically allow for such discrepancies.

A vulnerability exists in Parsec Cloud versions prior to 3.3.3-rc.0 due to improper sanitization of workspace names. This flaw allows workspace names to include backslashes, potentially creating a Universal Naming Convention (UNC) path. When such a path is mounted in the Windows filesystem, the application may become unresponsive if the path is invalid. However, if the path is valid, the system will interact with the resource, enabling an attacker to capture NTLM authentication hashes.

A privilege escalation vulnerability has been identified in HCL Commerce that could lead to denial-of-service, unauthorized access to user personal data, and the execution of unauthorized administrative tasks. This vulnerability affects multiple versions of HCL Commerce, including WebSphere Commerce version 7, WebSphere Commerce versions 8.x, HCL Commerce versions 9.0 - 9.0.1.21, HCL Commerce versions 9.1.0 - 9.1.19, and HCL Commerce Plus Transaction Server up to version 25.09.17.

A vulnerability allowing input data manipulation has been identified in Gobito Corporate Training Management System, prior to version dd1a9df64. This client-side enforcement of server-side security issue could potentially be exploited by cyber attackers.

A signed integer overflow vulnerability has been identified in the ProFTPD FTP server software, specifically in versions prior to 1.3.9c and between 1.3.10rc1 and 1.3.10rc3. The vulnerability resides in the mod_sftp module's SCP size-record parser, where it allows authenticated low-privilege attackers to manipulate the file size value. By sending a crafted value of UINT64_MAX, the attacker can cause a negative off_t value, which is then converted to uint32_t. This conversion results in an approximately 4 GB read request, forcing the server to read beyond the end of the SSH channel data. The overread process memory is then written into the uploaded file. In tested scenarios, the extracted data includes pointers to libc, libcrypto, and the Position Independent Executable (PIE), which can be used to derive their randomized base addresses. This capability bypasses Address Space Layout Randomization (ASLR) and enables reliable exploitation of memory corruption vulnerabilities within the same process.

A heap-based buffer overflow vulnerability has been identified in the ProFTPD FTP server software, specifically in versions prior to 1.3.9c and between 1.3.10rc1 and 1.3.10rc3. This vulnerability resides within the mod_sftp module and allows authenticated low-privilege attackers to execute arbitrary code. The issue arises when crafted SFTP packet fragments exceeding 16 KB are sent, exploiting an improperly managed reallocation process. This leads to corruption of the memory pool's metadata, overwriting critical pointers to redirect function calls to system commands, effectively allowing code execution.

A vulnerability allowing remote code execution has been identified in Apache Syncope versions 3.0.0-M0 prior to 3.0.16, 4.0.0-M0 prior to 4.0.6, and 4.1.0-M0 prior to 4.1.1. This issue arises from improper isolation in the Groovy security sandbox, which can be bypassed by an administrator with the right entitlements. Such an administrator can create a malicious Groovy class containing untrusted code that exploits this weakness.

A low-privileged authenticated Server-Side Request Forgery (SSRF) vulnerability has been identified in Apache Syncope. This issue arises in the Connectors and Resources check, allowing for potential manipulation of server-side requests. The vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

A vulnerability in Apache Syncope related to improper privilege management has been identified. This issue arises when the all-Java user workflow adapter or the Flowable user workflow adapter is used, with a BPMN definition that does not require administrative approval for user self-registration or self-update requests. Under these conditions, a user can make a REST API call to assign themselves one or more defined roles. This unauthorized role assignment grants them corresponding entitlements, effectively allowing them to assume administrative privileges. The specific entitlements gained depend on the roles defined in the affected Syncope deployment. This vulnerability affects Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1.

A SQL injection vulnerability has been identified in Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. This vulnerability allows an administrator with the appropriate entitlements to execute arbitrary SQL by using stacked queries, taking advantage of unsanitized sort parameters.

A path traversal vulnerability has been identified in FileBrowser Quantum versions prior to 1.4.3-beta. The issue resides in the 'subtitlesHandler' endpoint, specifically 'GET /api/media/subtitles', where two user-controlled query parameters, 'path' and 'name', are used in filesystem operations without proper sanitization. This oversight creates two independent path traversal vectors. The primary vector involves the 'path' parameter, which is passed directly to 'idx.GetRealPath()' without being sanitized, enabling an attacker to escape the storage root and manipulate the 'parentDir' variable to point to any directory on the host. The secondary vector involves the 'name' parameter, which is concatenated with 'parentDir' using 'filepath.Join' without removing directory components, allowing traversal relative to any resolved 'parentDir'. Any authenticated user can exploit these vectors to read any text file accessible by the server process, including sensitive files like '/etc/passwd', SSH keys, database credentials, and JWT signing keys.

A username enumeration vulnerability has been identified in FileBrowser Quantum versions prior to 1.3.2-beta. The issue arises in the '/api/auth/login' authentication endpoint, which does not process requests in constant time. When an invalid username is provided, the server quickly returns a '401' or '403' response. In contrast, a valid username triggers a bcrypt password comparison, introducing a noticeable delay in the response. This timing difference allows an attacker to distinguish between valid and invalid usernames by measuring response times.

A remote code execution vulnerability has been identified in Apache Syncope versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1. This vulnerability arises from improper isolation in the connector subsystem, allowing an administrator with sufficient entitlements to execute arbitrary code by leveraging the capability of scripted connectors (REST and SQL) to run Groovy scripts.

A vulnerability allowing remote code execution has been identified in Apache Syncope versions 3.0.0-M0 prior to 3.0.16, 4.0.0-M0 prior to 4.0.6, and 4.1.0-M0 prior to 4.1.1. This issue arises from improper isolation in the handling of BPMN process definitions. An administrator with the necessary entitlements can import arbitrary BPMN processes via the REST API. Once imported, these processes can be started, and if they include a Groovy scriptTask, the script is executed on the server without any sandboxing, posing a significant security risk.

A directory traversal vulnerability has been identified in Menyoo version 2.0, prior to commit 729aa48. This vulnerability allows local attackers to execute arbitrary code by exploiting the file management features of the Spooner, VehicleSpawner, WeaponOptions, and PedComponentChanger modules. The issue arises from insufficient validation of user-provided file and folder names, which can be manipulated to traverse directories and execute malicious code.

A stored cross-site scripting vulnerability has been identified in Frogman versions prior to 1.6.6. The issue arises in the chat console's markdown formatter, which improperly inserts user-controlled data as raw HTML in several template patterns, including inline code, bold text, markdown links, and download links. This flaw allows the injection of HTML/JavaScript payloads that execute in the session of any admin viewing the response through Frogman chat. The vulnerability exploits a lack of proper escaping in user-generated content, contrasting with FreePBX's admin GUI, which correctly sanitizes these fields. As a result, tool responses reflecting user-controlled data, such as extension names and ring-group descriptions, could trigger the execution of injected scripts when accessed by other admins via Frogman chat.