A vulnerability in PyTorch versions 2.5.0 up to but not including 2.5.1, and 2.7.1 up to but not including 2.8.0, allows a denial of service condition. The issue occurs when the profiler.stop() function is omitted, causing the torch.profiler.profile (PythonTracer) to crash or hang during finalization.
A vulnerability in Canonical's Pebble service manager read-file API and the associated pebble pull command before version 1.10.2 allows unprivileged local users to read files with root-equivalent permissions when Pebble is running as root. Fixes are available in version 1.10.2 and backported to versions 1.1.1, 1.4.2, and 1.7.4. This issue affects multiple version ranges prior to these fixed versions.
In PHP versions 8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1 when using the PDO PostgreSQL driver with PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence (such as \x99) in a prepared statement parameter may cause the quoting function PQescapeStringConn to return NULL, leading to a null pointer dereference in pdo_parse_params() function. This may lead to crashes (segmentation fault) and affect the availability of the target server.
Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be served to web browsers causing cross-site scripting (XSS) (CAPEC-63) via a method in Vega bypassing a previous Vega XSS mitigation.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.2 and 9.1.1-alpha.1, the Instagram authentication adapter allows clients to specify a custom API URL via the `apiURL` parameter in `authData`. This enables SSRF attacks and possibly authentication bypass if malicious endpoints return fake responses to validate unauthorized users. This is fixed in versions 8.6.2 and 9.1.1-alpha.1 by hardcoding the Instagram Graph API URL `https://graph.instagram.com` and ignoring client-provided `apiURL` values. No known workarounds are available.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verification HTML pages. The patch, available in versions 8.6.1 and 9.1.0-alpha.3, escapes user controlled values that are inserted into the HTML pages. No known workarounds are available.
Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissions, giving it access to GitHub secrets and write permissions which are defined in the workflow. Code from a fork or lifecycle scripts is potentially included. Only the repository's CI/CD infrastructure is affected, including any public GitHub forks with GitHub Actions enabled. This issue is fixed version 8.6.0-alpha.2 and commits 6b9f896 and e3d27fe.
A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific conditions which are not predictable and exist for a very short period of time. This error can cause the transaction coordination logic to misinterpret the transaction as committed, resulting in inconsistent state on those shards. This may lead to low integrity and availability impact.
This issue impacts MongoDB Server v8.0 versions prior to 8.0.16, MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB server v8.2 versions prior to 8.2.2.
A Time-of-check Time-of-use (TOCTOU) race condition vulnerability (CVE-2024-9183) was found in GitLab CE/EE versions 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1. This flaw could allow an authenticated user to obtain credentials from higher-privileged users and perform actions in their context under specific conditions. The issue has been remediated in the stated fixed versions.
Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication via a malicious search_path parameter in the StartupMessage.
MongoDB Server versions prior to 7.0.26, 8.0.16, and 8.2.2 on Windows and Apple platforms improperly validate Extended Key Usage (EKU) fields during TLS handshakes. This allows clients or servers with certificates missing the required EKU attributes (clientAuth or serverAuth) to successfully complete TLS handshakes. Linux systems are not affected by this issue. The vulnerability has been fixed in the specified later versions.
A use-after-free vulnerability in the MongoDB server query planner can cause the server to crash or exhibit undefined behavior. This occurs when an authorized user issues a DDL operation concurrently with queries under certain conditions. The issue affects MongoDB Server versions 7.0.0 up to but not including 7.0.25, and 8.0.0 up to but not including 8.0.15. Version 8.2.0 is also mentioned but without explicit affected range. A patch is available to address this vulnerability.
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1, incorrect path handling with groupfolders caused the admin_audit app to not properly log all actions on files and folders inside groupfolders. This vulnerability is fixed in Nextcloud Server and Enterprise Server prior to 30.0.9 and 31.0.1.
Nextcloud Server and Enterprise Server versions prior to 31.0.1 contain an authorization bypass vulnerability (CVE-2025-66547) that allows non-privileged users to modify tags on files they should not have access to via bulk tagging. This issue is fixed in version 31.0.1. The vulnerability has a medium severity with a CVSS score of 4.3.
Nextcloud Server is a self hosted personal cloud system. In Nextcloud Server prior to 31.0.10 and 32.0.1 and Nextcloud Enterprise Server prior to 28.0.14.11, 29.0.16.8, 30.0.17.3, and 31.0.10, contacts search allowed to retrieve personal data of other users (emails, names, identifiers) without proper access control. This allows an authenticated user to retrieve information about accounts that are not related or added as contacts.
A missing authorization vulnerability in GitLab CE/EE versions from 13.7 up to but not including 18.2.8, 18.3 up to but not including 18.3.4, and 18.4 up to but not including 18.4.2 allowed authenticated users without project membership to view sensitive manual CI/CD variables via the GraphQL API. This issue has been remediated in later versions.
A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other users. This may cause a denial of service by preventing a fraction of queries from successfully completing. This issue affects MongoDB Server v7.0 versions prior to 7.0.26 and MongoDB Server v8.0 versions prior to 8.0.14
A missing authorization vulnerability in GitLab CE/EE versions from 13.2 up to but not including 18.3.6, 18.4 up to but not including 18.4.4, and 18.5 up to but not including 18.5.2 allowed authenticated users with reporter access to view branch names and pipeline details via the packages API endpoint even when repository access was disabled. This issue has been remediated in versions 18.3.6, 18.4.4, and 18.5.2.
A vulnerability in GitLab CE/EE versions from 16.7 up to but excluding 18.3.6, 18.4 up to but excluding 18.4.4, and 18.5 up to but excluding 18.5.2 could allow a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections. This issue has been remediated in the specified fixed versions.