ExcelJS versions through 4.4.0 have a memory exhaustion vulnerability in the Worksheet._parseMergeCells function. This flaw allows attackers to crash applications by providing unbounded mergeCell ranges in crafted Excel workbooks. Specifically, a mergeCell reference such as A1:XFD1048576 causes the xlsx.load() method to create billions of Row and Cell objects, leading to process abortion due to resource exhaustion.
Miniflux versions prior to 2.3.5 have a vulnerability where session expiration is insufficient. This flaw allows attackers who possess a leaked password or copied session cookie to maintain access to the account for up to 30 days, even after the password is changed. Persistent access enables reading integration credentials, creating API keys, or registering passkeys.
Listmonk versions 6.0.0 up to but not including 7.0.0-beta.2 contain a vulnerability that allows bypassing two-factor authentication (2FA). Attackers with valid passwords can brute-force Time-based One-Time Password (TOTP) codes because the attempt counter resets on each new password login. This enables repeated login attempts via the POST /admin/login endpoint, allowing attackers to gain sessions for 2FA-protected accounts, including Super Admin accounts.
listmonk versions 6.0.0 up to but not including 7.0.0-beta.2 contain an authentication bypass vulnerability in the doResetPassword function. This flaw allows attackers who can complete a password reset—such as by accessing the victim's reset email—to bypass TOTP verification and gain fully authenticated sessions, including Super Admin privileges.
Contao versions before 5.3.54, 5.7.17, and 6.0.6 do not invalidate existing user sessions when two-factor authentication (2FA) is enabled or disabled. This occurs because the user equality check and serialized session data omit the 2FA state, allowing attackers who already hold a session to retain access even after the legitimate user changes their 2FA settings.
ExcelJS versions through 4.4.0 have a memory exhaustion vulnerability that allows attackers to crash applications by providing a worksheet column element with an unbounded max attribute. This causes the xlsx.load() function to allocate an excessive number of Column objects, leading to an uncatchable heap out-of-memory error and process termination.
Dokploy versions from 0.28.0 up to but not including 0.31.1 contain a path traversal vulnerability. This flaw allows authenticated organization members with service read permission to read arbitrary files on the Dokploy host or managed remote servers by using '../' sequences in the filePath parameter of the patch.readRepoFile function. Sensitive files such as /etc/shadow, SSH private keys, and secret environment files can be accessed, potentially exposing critical secrets.
Dokploy versions from 0.28.0 up to but not including 0.31.1 contain a path traversal vulnerability. This flaw allows authenticated organization members with read access to a service to list files and directories of any git repository by providing an arbitrary repository path. As a result, attackers can enumerate file and directory names belonging to other tenants' applications and reconstruct source trees on the host or managed servers.
listmonk versions 6.2.0 up to but not including 7.0.0-beta.2 have a missing authentication vulnerability. This flaw allows unauthenticated attackers to submit forged Azure Event Grid bounce webhook events when no shared secret is configured. Attackers can send POST requests with EmailDeliveryReportReceived events marked as Bounced to the /webhooks/service/azure endpoint, enabling them to blocklist, unsubscribe, or delete arbitrary subscribers without authorization.
ExcelJS versions up to 4.4.0 have a prototype pollution vulnerability. This flaw allows attackers to add numeric keys to Object.prototype by crafting an XLSX file with a defined name referencing a __proto__ sheet. When such a file is loaded using workbook.xlsx.load(), it causes the CellMatrix component to write empty arrays onto Object.prototype, affecting the process globally.
OpenMage magento-lts versions 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have an unrestricted file upload vulnerability. The vulnerability arises because the blocklist for protected file extensions does not include phar, php8, and phps files. This allows unauthenticated attackers to upload a .phar file via a product File custom option to a predictable path and execute code on servers that treat .phar files as PHP.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 have a reflected cross-site scripting (XSS) vulnerability in error pages. The vulnerability arises because error pages print SCRIPT_NAME-derived URLs from errors/processor.php without proper escaping. This allows unauthenticated attackers to craft malicious links that trigger uncaught exceptions, causing script execution in the storefront origin within victims' browsers.
An unbounded decompression vulnerability exists in actix-http before 3.20.1 and actix-web before 4.18.2 in the encoding::Decoder component. This flaw allows remote attackers to exhaust server memory and CPU resources by sending small, highly compressed request bodies using gzip, deflate, Brotli, or zstd compression. The vulnerability affects various extractors such as Json, Form, Bytes, or String, as well as awc clients, potentially causing denial of service.
GPAC versions up to 26.07.0 have a use-after-free vulnerability in the function gf_sg_proto_del() located in src/scenegraph/vrml_proto.c. This occurs because gf_sg_reset() frees unregistered prototypes that are still referenced by scene commands. An attacker can exploit this by supplying a crafted XMT/BT scene with prototype declarations processed by MP4Box -chap, causing a crash due to freed memory access.
Scapy versions before 2.8.0 have a denial of service vulnerability in the BER_num_dec() and BERcodec_OID.do_dec() functions. This flaw allows remote attackers to exhaust CPU resources by sending ASN.1/BER data with oversized OID arcs containing many base-128 continuation bytes. On Python 3.11 and later, this can also cause an uncaught ValueError crash.
Scapy versions before 2.8.0 have an uncontrolled recursion vulnerability in the BER/ASN.1 decoder that can be triggered by a specially crafted packet containing deeply nested ASN.1 SEQUENCE structures. This causes a RecursionError that crashes parsers for protocols such as TLS, SNMP, X.509, and LDAP, leading to denial of service.
GPAC versions through 26.07.0 have a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers. This flaw occurs when processing crafted XMT scenes with Form constraints referencing non-existent groups, causing a crash in tools like MP4Box during chapter import. The vulnerability leads to denial of service by crashing the affected process.
The xmlwf tool in libexpat versions through 2.10.0 has a symlink following vulnerability. When run with the -d output mode, it opens files using fopen("wb"), which follows symbolic links. This allows local attackers with write access to the output directory to create a symlink at the expected output filename, potentially truncating or overwriting files writable by the xmlwf user.
OpenMage magento-lts versions prior to 20.18.2 and 21.0.0-beta3 contain an authorization vulnerability where admin controllers improperly check permissions. This flaw allows authenticated restricted administrators to perform unauthorized actions such as mass canceling or holding orders, modifying order shipping addresses, exporting customer report data, or creating REST roles despite lacking explicit permissions.
OpenMage magento-lts versions before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contain a stored cross-site scripting (XSS) vulnerability. This occurs because certain storefront templates output product names without proper escaping. Attackers with admin product-edit rights can inject malicious scripts into product names, which execute when shoppers view affected pages.