Froxlor versions before 2.3.13 expose the raw PEM TLS private key content in JSON API responses for certificate-related commands. This occurs because the ssl_key_file column is returned verbatim without filtering, allowing low-privileged authenticated API users to access private keys of their own domains. Reseller and admin accounts with broader privileges can access private keys of other users. Exposure of these private keys can lead to domain impersonation, passive decryption of TLS traffic, and man-in-the-middle attacks.
Froxlor versions through 2.3.10 contain a vulnerability allowing authenticated users with write access to an FTP home directory to cause arbitrary file deletion via symlink following in a root-executed cron task. This occurs because the FTP data deletion cron job improperly handles symlinks, leading to potential cross-tenant data destruction and denial of service. The issue is resolved in Froxlor version 2.3.12.
Froxlor versions 2.3.10 and earlier contain a critical vulnerability in the customer data-export cron job. The vulnerability arises from improper validation of intermediate path components in the export destination, allowing an authenticated customer to create symlinks that cause the cron job to recursively change ownership of arbitrary directories, including sensitive system paths. This can lead to host root and cross-tenant compromise. The issue is fixed in Froxlor version 2.3.12.
froxlor versions before 2.3.12 do not invalidate existing panel sessions, API keys, and 2FA trust cookies when a user changes their password. This allows attackers who have hijacked sessions or possess valid API keys or 2FA trust tokens to maintain full account access even after password rotation, effectively bypassing incident response measures.
Kyverno versions 1.16.0 through 1.19.0 have a vulnerability where the globalcontext.Lib CEL library is registered in the policy environment without namespace confinement. This allows a tenant with permission to create namespaced policies to access cached cluster-scoped global context entries, including data from namespaces they do not have RBAC permissions to read. The issue is fixed in version 1.19.1.
Kyverno versions 1.14.0 through 1.19.0 contain a vulnerability in the ImageValidatingPolicy evaluator where it fails to properly read the spec.images and spec.allowedValues fields of a PolicyException. This causes image signature verification to be skipped for all images in a matched resource when an exception is intended only for specific images, allowing unsigned or untrusted images to be admitted without verification. The issue is resolved in version 1.19.1.
Kyverno versions prior to 1.19.1 contain a server-side request forgery (SSRF) vulnerability. This issue arises because certain legacy API call paths do not enforce egress filtering or validate service URLs, allowing crafted policies or resource submitters to make Kyverno send HTTP requests to arbitrary internal or external hosts. The vulnerability can lead to unauthorized access to cloud metadata endpoints and internal services using Kyverno's network privileges. The flaw is fixed in version 1.19.1.
A vulnerability in stoatchat versions before 0.15.5 allows attackers to bypass multi-factor authentication (MFA) by using their own valid MFA ticket combined with another user's session token. This flaw enables unauthorized actions such as disabling TOTP, viewing recovery codes, or performing other sensitive operations without the victim's credentials.
January, the media proxy/embed service of stoatchat, before version 0.15.5, improperly resolves SVG <image href> values as local filesystem paths when serving image/svg+xml content. This allows an unauthenticated remote attacker to probe for local file existence via timing differences and disclose local image files after re-encoding. The vulnerability can also cause unbounded local filesystem I/O and memory pressure, leading to denial of service. The issue is fixed in version 0.15.5.
Stoatchat versions before 0.15.5 have a denial of service vulnerability in the acknowledgement worker that handles mass mention messages. Authenticated users can exploit this by sending five crafted role-mention messages, causing all acknowledgement workers to terminate. This disables push notifications and mention badges across the deployment until the API process is restarted.
stoatchat versions before 0.15.5 do not properly revalidate usernames after Unicode sanitization. This allows attackers to create usernames containing forbidden characters by submitting Unicode letters that transform into rejected characters. Attackers can bypass character allowlists and length limits, enabling creation of reserved-name lookalikes, embedding special characters, and exceeding the 32-character storage limit.
Stoatchat versions before 0.15.5 do not enforce account-level attempt limits on multi-factor authentication (MFA) login challenges. This allows attackers who have obtained a user's password to repeatedly guess Time-based One-Time Password (TOTP) codes. The vulnerability arises because only IP-based rate limiting is applied, which can be bypassed by reusing MFA challenge tickets across multiple failed attempts and distributing guesses across different IP addresses.
Stoatchat versions before 0.15.5 have an account enumeration vulnerability in the login endpoint. This flaw allows unauthenticated attackers to differentiate between registered and unregistered email addresses by analyzing error responses that expose source file locations. The vulnerability is identified as CVE-2026-100677 and has a medium severity rating with a CVSS score of 5.3.
Netty's io.netty:netty-codec-http library contains an unbounded per-connection queue in the WebSocketServerExtensionHandler. This queue grows with each inbound HTTP request but is only reduced when the application sends an HTTP response. A remote unauthenticated attacker can exploit HTTP/1.1 pipelining to send requests faster than responses are produced, causing the queue to grow indefinitely and potentially leading to JVM OutOfMemoryError crashes. This affects versions 4.1.88.Final through 4.1.137.Final and 4.2.0.Final through 4.2.17.Final. The issue is fixed in versions 4.1.138.Final and 4.2.18.Final.
SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (CheckAuth in kernel/model/session.go and IsSessionOriginAllowed in kernel/util/net.go) fail open when the HTTP Origin header is absent, on the incorrect assumption that any browser-initiated cross-site request carries an Origin. Because browsers omit Origin on cross-site top-level GET navigations and no-cors GET subresource loads — and the session cookie is SameSite=Lax — a single cross-site GET issued from any attacker-controlled web page is granted RoleAdministrator, both on default installations with no access-authorization code and on password-protected instances with a live session. Combined with content-type sniffing on the /api/network/proxy endpoint, which allows attacker-controlled HTML to be served under SiYuan's own origin, this permits an unauthenticated remote attacker to execute arbitrary script in the SiYuan origin (http://127.0.0.1:6806), invoke administrator APIs, and exfiltrate the persistent kernel API token. This issue is fixed in version 3.8.4.
A SQL injection vulnerability exists in the mathurvishal CloudClassroom-PHP-Project within the mydetailsfaculty.php file via the myfid parameter. This flaw allows remote attackers to manipulate SQL queries, potentially impacting confidentiality, integrity, and availability. The product lacks versioning, so specific affected versions cannot be identified. No vendor response or patch is available. The vulnerability has a CVSS score of 7.3, indicating medium severity. Public exploit code is available, but no exploitation in the wild has been reported.
The npm package 'chai-as-relay' version 1.2.1 contains a heavily obfuscated, multi-megabyte self-executing code blob that executes upon requiring the package. This package impersonates the legitimate 'pino' logger project by copying its non-malicious files but includes a malicious payload that allows arbitrary code execution. The package author and name have no relation to the genuine pino maintainers, indicating a supply chain attack via a malicious package.
The npm package 'cma-self-hosted-sandbox-cf' version 1.0.0 contains malicious code that executes automatically during installation. It collects sensitive system information including hostname, user details, home directory, DNS servers, and contents of /etc/passwd and /etc/hosts. This data is exfiltrated via HTTPS POST to an attacker-controlled domain unrelated to the package's legitimate function. This behavior constitutes a dependency confusion and reconnaissance exfiltration attack.
Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final do not enforce the RFC 9114 requirement that the :authority pseudo-header and the literal host header, when both are present, must have the same value. This flaw allows a remote unauthenticated attacker to send a HEADERS frame with conflicting authority values, potentially bypassing routing, virtual-host, and access-control decisions. The issue is fixed in version 4.2.18.Final.
Netty's HTTP/3 codec versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the QPACK prefixed-integer decoder. The decoder does not limit the number of continuation bytes it processes, allowing a remote unauthenticated attacker to cause unbounded memory growth and CPU exhaustion. This results in OutOfMemoryError and event-loop CPU starvation. The issue is fixed in version 4.2.18.Final.