Advisories

WordPress Coding Standards (WordPressCS) versions before 3.4.1 contain an arbitrary code execution vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. As a result, running PHPCS with WordPressCS over untrusted PHP code, for example, in a CI pipeline that lints pull requests, or on a developer machine reviewing third-party code, could lead to arbitrary command execution on the scanning host. This affects users of the WordPress and WordPress-Extra rulesets. The WordPress-Core ruleset and the …

A remote, unauthenticated attacker can cause excessive memory allocation (and resulting CPU / GC pressure, potentially OOM termination) by sending a crafted unencrypted MTProto packet. (*proto.UnencryptedMessage).Decode read an attacker-controlled 32-bit dataLen field and immediately allocated a buffer of that size via make([]byte, dataLen) before validating that the underlying buffer actually contained that many bytes. A 20-byte packet declaring a ~1.75 GB payload (e.g. dataLen = 0x70000000) forces the runtime to …

Prototype pollution. A malicious user can create a token array [{ key: '{proto.foo}', value: 'malicious' }], when processed by convertTokenData() utility function, it will pollute the Object.prototype globally where {}.foo will equal { key: '{proto.foo}', value: 'malicious' }. This has been confirmed with a test/reproduction. You are impacted when: direct usage of convertTokenData(tokens, { output: 'object' }); indirect usage, via using Expand API https://styledictionary.com/reference/config/#expand. If your expand config deems it …

Using Database#create_function or Database#define_function to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.

Using Database#create_function or Database#define_function to define the same function name more than once with different numbers of arguments ("arity") or text encodings will result in a invalid memory read and a segmentation fault.

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

Using Database#create_aggregate, #create_aggregate_handler, or Database#define_aggregator to define an aggregate function, and then using an open statement calling that function after the database has been explicitly closed will result in an invalid memory read and a segmentation fault.

skilo add installs a skill by recursively copying the skill directory into the target skills directory. The copy routine (copy_dir_all) classified each entry with std::fs::DirEntry::file_type() — which does not follow symlinks — and then copied non-directory entries with std::fs::copy(), which does dereference symlinks. As a result, a skill containing a symbolic link such as reference.txt -> /home/<user>/.ssh/id_rsa was copied as a regular file whose contents are the link's target. A …

A single malformed inbound UDP packet on the RTP/ICE socket can remotely terminate an active RTP or WebRTC media session. The packet receive handler indexes packet (and STUN attribute) bytes without sufficient length checks and throws, and the UDP receive loop converted any such exception into a channel Close rather than dropping the packet. One small, unauthenticated packet therefore ends the media session. This is reachable during ICE connectivity checks …

The relay's reconnect handler forwards every RECONNECT_REQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send RECONNECT_REQUEST packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter …

The relay's reconnect handler forwards every RECONNECT_REQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send RECONNECT_REQUEST packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter …

The relay's reconnect handler forwards every RECONNECT_REQUEST to the host without deduplication or a size cap on the pendingReconnects map, unlike the connect flow which guards against this with maxPendingConnections. An unauthenticated attacker who knows a valid session ID can send RECONNECT_REQUEST packets from many spoofed source addresses; each packet that passes the session lookup is forwarded to the host as a new reconnect attempt. Because the per-source rate limiter …

TonapiWebhookDispatcher in pytonapi 2.2.0 fails to validate the Authorization header when a webhook handler is registered with the documented path= argument. During setup(), bearer tokens are stored only under the default suffix paths (e.g., /hook/account-tx), but the custom path (e.g., /hook/custom) is never added to the token map. When an incoming request arrives at the custom path, self._tokens.get(path) returns None, causing the if expected_token is not None guard to evaluate …

The authentication rate limiter used for the login and two-factor checkpoint endpoints applies a single global bucket shared by every client, instead of keying per IP or per account. An unauthenticated attacker sending ~10 requests per minute from one IP exhausts the shared bucket and causes HTTP 429 for every user on every IP attempting to log in or complete 2FA, for as long as the attack is sustained. This …

A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing server_uuid, user_uuid, and unique_id, regardless of the token’s intended purpose. Because the Panel issues JWTs with these same claims for other lower-privilege operations (such as WebSocket authentication and file download links), an authenticated subuser can reuse one of those tokens to upload arbitrary files without possessing …

A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing server_uuid, user_uuid, and unique_id, regardless of the token’s intended purpose. Because the Panel issues JWTs with these same claims for other lower-privilege operations (such as WebSocket authentication and file download links), an authenticated subuser can reuse one of those tokens to upload arbitrary files without possessing …

Poweradmin v4.3.2 uses the attacker-controlled HTTP_HOST request header as the authoritative source for building callback URLs in its OIDC, SAML, and logout authentication flows without any validation. An unauthenticated attacker can poison the redirect_uri sent to the Identity Provider, causing the IdP to redirect the victim's authorization code to an attacker-controlled server - resulting in full account takeover with no credentials required. Three independent code paths are affected: Primary (Critical): …

The createTokenFromRefreshToken function (oidc_service.go:451) validates the refresh token's cryptographic integrity but does not re-validate the user's current authorization state before issuing new tokens. This allows three bypasses: Authorization revocation bypass: After a user revokes an OIDC client's authorization, the client can continue refreshing tokens indefinitely because RevokeAuthorizedClient does not delete associated refresh tokens, and the refresh flow does not check if the authorization record still exists. Disabled user bypass: After …

A weaker authentication method (OTA token or signup token) is accepted as passkey step-up proof, yielding unauthorized renewable 30-day OIDC refresh tokens for clients explicitly configured with RequiresReauthentication: true. The POST /api/webauthn/reauthenticate endpoint's access-token fallback checks only JWT freshness (IssuedAt within 60 seconds), not the authentication method used. The session cookie gate is also non-validating – any arbitrary cookie value (e.g. session=deadbeef) is accepted, collapsing the reauth boundary to token …

Pagy::I18n.locale= did not validate its argument before using it as a path component to load the matching dictionary file (<locale>.yml). An application that assigns untrusted input to the locale — e.g. the common pattern Pagy::I18n.locale = params[:locale] — let that input influence which file Pagy attempted to load.

openhole-server forwarded the URL-decoded request path (r.URL.Path) to tunnel clients instead of the original request-target. Percent-encoded dot-segments (%2e) and separators (%2f) were decoded to ../ and / before reaching the local service. Go's ServeMux rejects literal ../ paths, but percent-encoded traversal sequences bypassed this and were delivered to backends as working path traversal.

When an application uses OAuth2::Client (typically via an OAuth2::AccessToken) and the configured authorization server returns a redirect whose Location header is a protocol-relative URI of the form //attacker.example/leak, OAuth2::Client#request resolves the redirect with response.response.env.url.merge(location). Per RFC 3986 §5.2, an input that starts with // is a network-path reference and replaces the authority of the base URL: URI("http://idp.trusted/userinfo").merge("//attacker.example/leak") returns http://attacker.example/leak. The recursive request(verb, full_location, req_opts) call then re-sends the request to …

When an application uses OAuth::Consumer to request OAuth 1.0 request tokens or access tokens, the token request helper follows 300..399 redirects returned by the OAuth server. In affected versions, OAuth::Consumer#token_request parses the raw Location header, follows the redirect recursively, and can mutate the consumer's configured site when the redirect points to a different host with the same path. The result is a cross-origin signed-request disclosure primitive: if an OAuth server …

Registry-installed nono packs are expected to be verified from local provenance metadata before they are used. Two files are relevant: ~/.config/nono/packages/lockfile.json ~/.config/nono/packages/<namespace>/<pack>/.nono-trust.bundle Testing shows that nono fails closed when a pack has a trust bundle but no lockfile entry. However, if the trust bundle is also absent, the same pack can load successfully. Deleting security metadata should not make a pack easier to run.

The checkSQL() function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete: it only checks for a subset of dangerous PostgreSQL system functions and does not restrict access to sensitive system catalog tables such as pg_shadow, pg_roles, or pg_stat_activity. An authenticated user with the admin role can exploit this to dump PostgreSQL password hashes (pg_shadow), …

Microsoft is releasing this security advisory to provide information about a vulnerability in System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A vulnerability exists in EncryptedXml class where a buffer overflow can give an attacker to the ability to perform a Denial of Service attack.

An inverted-boolean bug in lettre's boring-tls integration silently disables TLS hostname verification for callers using the default (strict) configuration. An on-path attacker presenting any chain-valid certificate for any domain can intercept SMTP submission, including PLAIN/LOGIN credentials and message contents, against any lettre user built with the boring-tls feature. Other TLS backends (native-tls, rustls) are unaffected.

When directConnect(true) is enabled, appium/java-client unconditionally accepts directConnectHost, directConnectPort, and directConnectPath from the server's NEW_SESSION response and silently redirects all subsequent session traffic to the attacker-specified endpoint — with no allowlist, no host validation, and no user notification.

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before …

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before …

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before …

GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete) and added recursive ACL resolution, and its description states the read/list path correctly enforces .goshs. That premise does not hold for the ?bulk zip-download route. bulkDownload (httpserver/updown.go) takes one or more ?file= parameters, runs each through sanitizePath(fs.Webroot, file), and streams the contents back as a ZIP without ever calling findEffectiveACL/applyCustomAuth. It is dispatched from earlyBreakParameters (?bulk) before …

Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (-b ':pass'). The empty-password variant bypasses that fix.

Start goshs v2.1.3 with -b 'admin:' -sftp. No -fkf. SFTP accepts connections without password. CVE-2026-40884 blocks the empty-username variant (-b ':pass'). The empty-password variant bypasses that fix.

sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.

sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.

sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.

sendFile derives the served filename from the raw request path while opening the file from the cleaned path, so appending a trailing slash empties the derived name and defeats both the never-serve rule for the ACL file and the block list.

The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.

The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.

The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.

The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree.

The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce –no-delete on the WebDAV MOVE verb. MOVE deletes the source file (rename removes it from its original path), and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w –no-delete, DELETE is correctly blocked (403) but MOVE still destroys existing files, defeating the documented "Disable the delete option" boundary. This is a residual of …

The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce –no-delete on the WebDAV MOVE verb. MOVE deletes the source file (rename removes it from its original path), and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w –no-delete, DELETE is correctly blocked (403) but MOVE still destroys existing files, defeating the documented "Disable the delete option" boundary. This is a residual of …

The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce –no-delete on the WebDAV MOVE verb. MOVE deletes the source file (rename removes it from its original path), and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w –no-delete, DELETE is correctly blocked (403) but MOVE still destroys existing files, defeating the documented "Disable the delete option" boundary. This is a residual of …

The WebDAV mode-flag guard added to fix GHSA-3whc-qvhv-xqjp still does not enforce –no-delete on the WebDAV MOVE verb. MOVE deletes the source file (rename removes it from its original path), and with Overwrite: T it additionally performs an explicit RemoveAll on the destination. Under -w –no-delete, DELETE is correctly blocked (403) but MOVE still destroys existing files, defeating the documented "Disable the delete option" boundary. This is a residual of …

The sFlow ExtendedGatewayFlow record decoder in github.com/gopacket/gopacket allocates a slice with make([]uint32, n) where n is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens before the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This …

The Diameter AVP decoder in github.com/gopacket/gopacket computes dataLength := avp.Length - uint32(headerSize) without first ensuring avp.Length >= headerSize. When the Vendor flag is set, headerSize is 12, but the only length guard upstream rejects avp.Length < 8. An AVP with the Vendor flag set and a 24-bit Length field of 8, 9, 10, or 11 therefore underflows the uint32 subtraction to ~4,294,967,292, which is passed straight to make([]byte, dataLength). A …

A nil pointer dereference vulnerability in the GitHub MCP Server causes it to crash when receiving a malformed completion/complete request with missing or empty parameters. This allows any unauthenticated client to cause a complete denial of service.

SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefix(path, safedir). This is a lexical check, not a directory boundary check: /packages-extra/evil starts with /packages, so it passed. The function did not enforce a path-separator boundary, so any sibling directory whose name began with the safe-directory string was accepted. Callers included the builder's Clean handler (pkg/builder/builder.go:208) and the fetcher's Fetch / Upload handlers (pkg/fetcher/fetcher.go). A …

Fission v1.24.0 added PodSpec safety validation for tenant-facing Environment and Function CRDs (ValidatePodSpecSafety / ValidateContainerSafety admission webhook + sanitizeContainerSecurityContext executor merge layer), but the capability check was implemented as a fixed denylist of six Linux capabilities (SYS_ADMIN, NET_ADMIN, SYS_PTRACE, SYS_MODULE, DAC_READ_SEARCH, DAC_OVERRIDE). The denylist omitted CAP_SYS_TIME, among others. As a result, a tenant who could create a Function or Environment CRD could request securityContext.capabilities.add: ["SYS_TIME"], pass Fission's admission validation and …

HTTPTriggerSpec.Validate() validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only (pkg/fission-cli/cmd/httptrigger/create.go:83). The post-CRD-modernization webhook for HTTPTrigger was retired in favor of API-server CEL — and CEL had no rules on those fields either — so an HTTPTrigger created via kubectl apply or a direct Kubernetes REST API call bypassed every URL-level check. A tenant with HTTPTrigger …

When datamodel-code-generator fetches a remote schema and follows an HTTP redirect, it re-sends the original request headers, including any Authorization header, to the redirect target even when the redirect changes origin (host/port/scheme). Credentials that an operator scoped to a trusted schema host are therefore forwarded to an attacker-controlled or otherwise different host, leaking them.

JSON-Schema $ref values pointing at HTTP or HTTPS URLs are silently dereferenced by datamodel-code-generator with no IP/host validation, no scheme allow-list, and redirects followed unconditionally. The –allow-remote-refs gate added in 0.56.0 defaults to None, which only emits a deprecation warning and then fetches the URL anyway; only explicit –allow-remote-refs=false blocks the request. The fetched body is parsed as a sub-schema and reflected verbatim into the generated .py source. As a …

datamodel-code-generator's built-in HTTP fetcher (http.get_body) issues an httpx.GET against any URL passed to –url (or reached via a redirect chain) with no allow-list, no deny-list, no IP/host validation, and follow_redirects=True. Loopback addresses, RFC1918 ranges, link-local (169.254.169.254 cloud metadata), unique-local IPv6 and any other network-accessible target are all reachable. The JSON/YAML response body is parsed as a schema and reflected into the generated .py source, exfiltrating the response to anyone with …

datamodel-code-generator's anti-SSRF guard validates the resolved IP of a fetch target once and then lets httpx perform its own independent DNS resolution to connect, so the validated address is never pinned. A hostname that resolves to a public IP at validation time and a private IP at connection time (DNS rebinding) bypasses the guard and reaches loopback, link-local cloud-metadata endpoints (169.254.169.254), and other internal services — even with the default …

A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in the extension value breaks out of the from … import … line and injects an attacker-controlled statement at module scope, which runs at import time. This is an unauthenticated, schema-content–driven remote …

When generating models from an XML Schema (–input-file-type xmlschema), datamodel-code-generator resolves <xs:include>, <xs:import>, <xs:redefine>, and <xs:override> schemaLocation attributes against the source directory and reads the target with no restriction to the input/base directory. An attacker who controls the input XSD can read arbitrary files via ../ traversal or an absolute path, and the included schema's contents (type names, restrictions, enumerations) are folded into the generated output. Unlike the JSON-Schema $ref …

datamodel-code-generator resolves JSON-Schema $ref targets that point at the local filesystem without restricting them to the input/base directory and without honoring the remote-reference security control. In the default configuration, an attacker who controls an input schema (a "paste your OpenAPI/JSON-Schema" service, a CI job that generates models from a submitted spec, or any multi-tenant codegen platform) can read any file the process user can read and map the host filesystem. …

GET /cosmos/api/constellation/public-devices discloses Constellation device metadata to a requester that supplies any non-empty Authorization header. The handler strips the string Bearer from the header but never validates the resulting token and never uses it in the database query. This was confirmed locally by routing a request through the real tokenMiddleware with Authorization: Bearer not-a-real-token. The request returned public Constellation device metadata from a disposable fixture. A missing-header negative control returned …

The Constellation-tunnel bypass branch in tokenMiddleware at src/proxy/routerGen.go:53-66 returns to the upstream handler before the request's x-cosmos-user, x-cosmos-role, x-cosmos-user-role, and x-cosmos-mfa headers are stripped at lines 68-72, and before the AdminOnlyWithRedirect gate at lines 109-117 runs. Any holder of a valid Constellation device API key sends x-cosmos-user: admin to a proxied backend; the documented forward-auth integration treats the caller as admin with no JWT cookie, password, or MFA.

CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained authorization decisions. Under certain circumstances, it could lead to incorrect equality comparisons.

datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled GraphQL schema. A description on a Union type, written in the regular-string form ("…") with a literal \r escape, is rendered into a Python # comment by a Jinja2 filter that handles only \n. Python's tokenizer treats a bare CR as a physical-line terminator, so the comment ends at the \r and the text after it is …

datamodel-code-generator is vulnerable to code injection when a developer passes an –extra-template-data file whose comment value contains a literal \r (carriage return). The comment variable is rendered into a Python # comment in six built-in templates with no line-terminator escaping. Python's tokenizer treats a bare CR as a physical-line terminator (see Python language reference — Physical lines), so the comment ends at the \r and the text after it is …

datamodel-code-generator is vulnerable to code injection when generating Python models from an attacker-controlled JSON Schema, OpenAPI, YAML, JSON, Avro, Protobuf, or XSD schema. When a property carries a "default_factory" key, its value is interpolated verbatim — as a raw Python expression — into the generated Field(default_factory=…) / field(default_factory=…) call. Because this assignment is evaluated at class-definition time (i.e. on import of the generated module), an attacker who controls the schema …

When the Pydantic v2 output mode is in use, datamodel-code-generator reads a validators array from each model entry in the –extra-template-data file and synthesises a Pydantic @field_validator(…) decorator from each entry. The field names and the validator mode are interpolated into the decorator call wrapped in unescaped single quotes. A value containing ' breaks out of the string literal, letting an attacker emit an arbitrary positional Python expression into the …

datamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial to bypass. An attacker who controls a JSON Schema fed to datamodel-codegen can therefore embed an arbitrary Python statement in the generated module, which executes at class-definition time …

@wakaru/cli is vulnerable to arbitrary file write when unpacking a crafted JavaScript bundle with –unpack. Bundle-controlled module filenames were sanitized before writing extracted modules to the output directory. A crafted filename containing overlapping path traversal characters, such as ….//, could be transformed into ../ after sanitization. This allowed the final output path to escape the intended output directory. An attacker who can cause a user to run wakaru –unpack on …

Novu's shared SSRF guard validateUrlSsrf(url) is used before server-side requests to user-configured URLs. The guard resolves hostnames and blocks a regex list of private/reserved IP ranges, but it does not block 100.64.0.0/10 shared address space. As a result, Novu features protected by this guard can still send server-side requests to destinations such as 100.100.100.200 (Alibaba Cloud metadata service) and any other service reachable in 100.64.0.0/10.

A SQL injection vulnerability exists in the escapeValue() function used for parameter substitution. Attackers who can control parameter values can inject arbitrary SQL by using a trailing backslash to escape the closing quote. Who is impacted: All users of @hypequery/clickhouse versions prior to 2.0.2 who pass user-controlled input as query parameters.

Unarchive in pkg/utils/zip.go joined each archive entry name with the destination directory via filepath.Join and wrote the result without checking whether the resolved path stayed under the destination. A zip entry named ../../tmp/evil therefore landed at /tmp/evil. An attacker who could control a Package.Spec.Source.URL or Deployment.URL archive could induce the fetcher (running as the per-environment pod's fission-fetcher sidecar) to write files anywhere that process could reach: into other tenants' /packages/<ns>/ …

It's possible to forge a request to delete a message.

If the –write-link, –write-url-link or –write-desktop-link options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the .url and .desktop shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated .url or …

An attacker can cause excessive memory allocation in webtransport-go by sending an unknown WebTransport capsule with a large payload. The implementation skips unknown capsules by reading the entire capsule body into memory, instead of draining it without retaining the data. This can lead to memory exhaustion.

Remote Code Execution (RCE) in velocityjs v2.1.6 via property-read to the Function constructor. This bypasses the fix for GHSA-j658-c2gf-x6pq ("Prototype Pollution in #set path assignment") — that advisory blocked constructor/proto/prototype only in the #set assignment handler (set.cjs), but property read expressions are unfiltered. Any application rendering attacker-controlled Velocity templates is vulnerable to arbitrary code execution on the server.

Edit permission lacks ownership check, so another developer could alter metadata that is later trusted by nodes. Worst they could do is update the image or image tag. If that is not noted, another image is approved than the one actually under review

valibot 1.4.1 can throw a TypeError inside its flatten() helper when validation issues contain attacker-controlled object keys such as toString, valueOf, or hasOwnProperty. The issue is reachable through normal record() validation. record() intentionally filters proto, prototype, and constructor, but it still accepts other own keys that collide with inherited Object.prototype properties. If the record key schema or value schema rejects such an entry, Valibot creates an issue path containing that …

The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock attachment, a <span> carrying an empty data-trix-attachment="{}". The empty attachment object caused the element to bypass attachment handling, so its data-trix-attributes were applied to a plain string piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without validation, so an attacker-supplied javascript: URI was carried into the …

The Trix editor, in versions prior to 2.1.18, is vulnerable to XSS when crafted HTML is pasted into the editor. The HTMLParser processed a mock attachment, a <span> carrying an empty data-trix-attachment="{}". The empty attachment object caused the element to bypass attachment handling, so its data-trix-attributes were applied to a plain string piece. The pre-2.1.18 StringPiece.fromJSON accepted the href without validation, so an attacker-supplied javascript: URI was carried into the …

SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting.

If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.

Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

Smithy-RS is a Rust code generation and runtime framework that generates HTTP clients and servers from Smithy interface definitions, powering the AWS SDK for Rust and custom service implementations. An issue exists where, under certain circumstances, allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service.

sm-crypto (npm package 0.4.0, the latest release, published 2026-01-20) generates SM2 private keys and signing ephemeral scalars from a single module-wide RNG instance (src/sm2/utils.js: const rng = new SecureRandom()). SecureRandom is jsbn's PRNG, which seeds an ARC4 stream from window.crypto.getRandomValues when available. In Node.js — sm-crypto's primary runtime — window is undefined, so the CSPRNG branch is skipped and the seed pool is instead filled from Math.random() (V8 xorshift128+, recoverable …

This impacts users of Shescape on Windows that explicitly configure shell to CMD, or true with the default shell being CMD, using the escape and escapeAll APIs. An attacker may be able to achieve shell injection depending on the original command. import * as cp from "node:child_process"; import { Shescape } from "shescape"; // 1. Prerequisites const options = { shell: "cmd.exe", // Or shell: true, // Only if the …

This impacts users of Shescape that have flag protection enabled, which is on by default, regardless of the API being used. An attacker can cause a runtime quadratic in the input size, causing denial of service for large inputs. import { Shescape } from "shescape"; // 1. Prerequisites const options = { //flagProtection unspecified // Or flagProtection: true, }; // 2. Payload let payload = "\u0000-".repeat(32000); // 3. Usage const …

This impacts users of Shescape on Unix systems that explicitly configure shell to Zsh, or true when the default shell is Zsh, using the escape and escapeAll. The Zsh options EXTENDED_GLOB and MAGIC_EQUAL_SUBST exacerbate the problem. In certain case, an attacker can leverage home directory expansion and extended glob syntax to obtain lists of files and directories on the system. Depending on what the command does, this may be used …

This impacts users of Shescape on Unix systems that explicitly configure shell to Dash, or true when the default shell is Dash, using the escape and escapeAll APIs in assignments prefixed to a command. An attacker may be able to obtain the location of the home directory and, depending on how it is used, change the location on which a command operates in unexpected ways. import * as cp from …

A type confusion issue in seroval.fromJSON() allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications that deserialize untrusted Seroval JSON with plugins enabled, this could allow attacker-controlled deserialization side effects. In downstream server frameworks that register plugins returning callable wrappers, this primitive could become unintended server-side …

A pre-authentication denial-of-service panic in russh 0.62.2 (commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22). An unauthenticated client sends a single SSH_MSG_KEX_ECDH_INIT whose Q_C is 32 zero bytes. russh's Curve25519 KEX does not reject the all-zero peer public value, so server_dh() computes the all-zero shared secret and compute_exchange_hash() then calls encode_mpint(&shared.0, …), which indexes s[i] at i == s.len() and panics (index out of bounds: the len is 32 …

A post-authentication denial-of-service panic in russh 0.62.2 (commit c4be19f1915c8682f4615c3fd50008512b474491, current default branch main as of 2026-07-22). An authenticated client sends a pty-req channel request carrying more than 130 terminal-mode records. The parser uses a fixed [(Pty::TTY_OP_END, 0); 130] array but increments its counter i for every valid record (logging "too many pty codes" without returning), then slices &modes[0..i] — an out-of-bounds slice that panics (range end index 131 out of …

A malicious SSH server can crash a russh client session with a single malformed key-exchange reply, causing a pre-authentication Denial-of-Service before the server host key is verified. The embedding process itself stays up, but the connection is killed deterministically.

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to out-of-memory exceptions or excessive CPU usage. We recommend updating immediately. The vulnerability exists in versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7 of: react-server-dom-webpack react-server-dom-parcel react-server-dom-turbopack

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8x6r-g9mw-2r78 that covers additional reported scenarios in which the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. [!NOTE] This only impacts Framework Mode applications. This does not impact your application if you are using Declarative or Data Mode.

This is a follow up to CVE-2026-22030 to address related CSRF flows in unstable RSC code paths. [!NOTE] This only affects your application if you are using the unstable RSC APIs

ray.data.read_webdataset(paths=…) is a @PublicAPI(stability="alpha") reader for WebDataset-format TAR files. Its default decoder=True invokes _default_decoder on every sample's keys, which routes file extension to a decoder by extension. Two of those branches deserialize attacker-controlled bytes with no validation: .pickle / .pkl -> pickle.loads(value) .pt / .pth -> torch.load(io.BytesIO(value), weights_only=False) Both fire during a standard ray.data.read_webdataset(…).take_all() / .iter_batches() call. No flags, no opt-in, no environment variable. An attacker who can supply a …

The Assembler component that assembles unordered stream fragments into consecutive chunks of the stream incurs some overhead for non-contiguous fragments. Readers that read from a RecvStream in order (through an AsyncRead impl for example) will be sensitive to peers that send fragments while leaving out early parts of the stream, and in particular, fragments with many gaps (because these cannot be defragmented). In such a scenario, the receiving connection suffers …

quasar@2.20.1, the latest published version at the time of testing, appears to be vulnerable to prototype pollution through the public extend() utility exported from the package root. When extend(true, target, source) is used for a deep merge, attacker-controlled object keys are recursively copied into the target object without blocking prototype-pollution primitives such as proto, constructor, or prototype. This can allow attacker-controlled properties to be written to Object.prototype.

The b64 extension inlines images referenced by <img src="…"> as base64 data URIs. When resolving the src path it joins it onto the configured base_path with os.path.normpath and opens the result directly, with no check that the resolved path stays inside base_path. A src containing ../ sequences, or an absolute path, therefore reads a file outside base_path as long as that file has an allowed image extension (.png, .jpg, .jpeg, …

The TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process.

Preface Poweradmin maps OIDC identities into local users through oidc_user_links.oidc_subject plus provider_id. In the MySQL schema, the OIDC link table explicitly uses utf8mb4_unicode_ci, which is case-insensitive and accent-insensitive. OIDC sub is a stable external subject identifier and should be matched byte-for-byte within the issuer/provider scope. The confirmed local PoC used two different OIDC users: Victim subject: victim-login Attacker subject: victím-login (í, U+00ED) MySQL reported those two subjects as equal under …

When you save a record edit, Poweradmin checks whether you're allowed to touch the record by looking at a zone id you send in the POST body, but it then applies the change to a record id you also send in the POST body. Nothing checks that the record id actually belongs to that zone id. So you point the permission check at a zone you legitimately own, point the …

The REST API user-update endpoint (PUT/PATCH /api/v2/users/{id} and the V1 equivalent) does not enforce two authorization rules that the web interface enforces. A user who holds the user_edit_others permission but is not a superuser can: edit user accounts that belong to a superuser, and set the password of any account, even without the user_passwd_edit_others permission. Because of this, a non-admin "user manager" role can send a single API request that …

Disclosure of the contents of arbitrary .map files reachable via path traversal (or absolute path when from is unset) from the process's filesystem. Affects any application processing CSS it does not fully trust without explicitly passing map: false. No authentication or user interaction beyond submitting CSS text is required.

pheditor's terminal feature restricts callers to an allowlist of commands (TERMINAL_COMMANDS) and rejects shell metacharacters. The allowlist is enforced as a PREFIX match with no argument validation, and the allowlist includes binaries that grant arbitrary command execution through their own options (find, git, php, tar, grep). A caller can therefore run any command using only allowlisted binaries and no rejected metacharacter, escaping the allowlist restriction the terminal feature relies on.

The forced password-change flow, triggered when the stored password is still the default (admin), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditor_password is enough to reach the password-change form, and submitting pheditor_new_password / pheditor_confirm_password in the same request is enough to set an arbitrary new password and obtain an authenticated session — without ever proving knowledge of the …

An authorization bypass and information disclosure vulnerability exists in the search API of Openlist. Due to a non-separator-aware path check and unfiltered backend counting, a low-privileged user can bypass their assigned BasePath restrictions to discover and access metadata of files residing in unauthorized sibling directories.

The /api/fs/batch_rename handler validates and authorizes only the requested source directory. It rejects path separators in new_name, but it does not validate src_name. The handler concatenates src_dir and attacker-controlled src_name, then passes the result to the filesystem rename layer, where the path is normalized. An authenticated user with rename permission can set src_name to traversal segments such as ../../ab/secret.txt. When the user's base path is /team/a and src_dir is /writable, …

An authorization bypass vulnerability exists in the file sharing mechanism of Openlist. Due to a flawed, non-separator-aware path validation check, an authenticated user can create share links for files outside their restricted base directory. This allows an attacker to bypass tenant/user isolation and gain unauthorized read access to arbitrary files within the system.

The DSMLv2 SOAP gateway (opendj-dsml-servlet) in OpenIdentityPlatform OpenDJ through 5.1.1 dereferences attacker-supplied xsd:anyURI values server-side without a scheme allowlist, egress filtering, or a size cap, and is reachable without authentication by default. A remote unauthenticated attacker can submit a DSML add/modify request whose value is a URI to (1) perform server-side request forgery against internal services and the cloud metadata endpoint (SSRF), (2) read local files via file: URIs, and …

When a SASL PLAIN bind supplies an authorization identity (authzid) that resolves to a different user, PlainSASLMechanismHandler verified only the PROXIED_AUTH privilege and never evaluated the "proxy" access-control right (the mayProxy ACI scope check). As a result, any account holding the proxied-auth privilege could assume any resolvable non-root identity without being granted a proxy ACI for that target. This diverges from every other proxy path in OpenDJ — the proxied-authorization …

The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth > 1. Because the Java serialization filter is consulted for every class in the graph (and depth == 1 only for the root's concrete class), the allowlist constrains only the root and leaves the entire nested graph unchecked.

A pre-authentication remote code execution vulnerability affects OpenAM. The remote authentication endpoint (/authservice, PLL) accepts an XML element that names an arbitrary Java class, which the server then loads and instantiates without validation. On a default configuration this is reachable without authentication and allows an attacker to run code on the server.

The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript in the OpenAM origin. This is the same vulnerability class as CVE-2026-44203; that fix did not cover this code path.

The fix for GHSA-r2wg-2mcr-66rv is incomplete in v0.9.6 and current main. backend/open_webui/routers/terminals.py documents _sanitize_proxy_path() as decoding until stable, but the implementation stops after 8 unquote() passes. A 9x percent-encoded ../… path parameter remains once-encoded after the loop, passes the posixpath.normpath() and cleaned.startswith('..') checks, and is forwarded to the configured terminal server. The upstream server then receives a decoded traversal path such as /base/../admin/system.

Open WebUI's file upload background processing trusts the client-supplied metadata.knowledge_id value and inserts a knowledge_file association before validating that the uploading user has write access to the target knowledge base. A verified user with only read access to a knowledge base can upload an arbitrary file and set metadata={"knowledge_id":"<target knowledge id>"}. The normal /api/v1/knowledge/{id}/file/add endpoint correctly requires knowledge-base write access, but the upload auto-link path bypasses that authorization check. The …

The Socket.IO server is configured with always_connect=True (lines 78, 91 in backend/open_webui/socket/main.py) and the connect handler (line 329) never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact with collaborative document sessions.

The terminal proxy in backend/open_webui/routers/terminals.py forwards the Open WebUI user's identity to the upstream terminal server / backend coordinator as an authorization claim, with no cryptographic binding to the session that produced it. The forwarded identity is attacker-influenceable on both proxy paths: HTTP path (proxy_terminal) sets headers['X-User-Id'] = user.id. Upstreams that trust X-User-Id as identity receive it unsigned, so an attacker who can reach the upstream by other means (directly, …

Open WebUI runs client-side Python (Pyodide) in a same-origin web worker. Through Pyodide's JavaScript API (pyodide.http.pyfetch, or the js module which exposes the page's fetch / XMLHttpRequest) executed Python can issue requests on the application origin, and those requests carry the victim's session cookie. A low-privileged user can store such a payload in a chat message, share the chat, and when a victim opens it and clicks Run the payload …

Open WebUI documents pending as a zero-access role used for new sign-ups and deactivated users, and normal HTTP routes enforce that with get_verified_user() (which rejects pending), while automation create/update/run routes additionally require the features.automations permission. Two paths missed that lifecycle gate, so a deactivated (pending) account could keep acting through the background automation scheduler: Scheduler did not re-gate the owner. When a stored automation became due, execute_automation() rehydrated the owner …

Two regexes in backend/open_webui/utils/middleware.py that parse <$skillId|label> skill-mention tags backtrack in O(n²) on input that contains <$ followed by a long run with no closing >. Both run synchronously, on the asyncio event loop, on every chat completion with no feature gate. Because the default deployment is a single uvicorn worker, one such input pins a CPU core inside re and freezes the entire instance for all users until the …

With Redis configured, Open WebUI supports JWT revocation: POST /api/v1/auths/signout (per-token jti) and OIDC back-channel logout (per-user revoked_at) record revocations in Redis, and HTTP auth (get_current_user) rejects revoked tokens with 401. The realtime authentication surfaces do not perform this check: Socket.IO connect / user-join / join-channels / join-note and the terminal websocket first-message auth validate tokens with decode_token() only (signature + expiry). A JWT revoked by sign-out or back-channel logout …

A normal authenticated user can read the content of a message in a private channel they do not belong to. GET /api/v1/channels/{id}/messages/{message_id}/thread authorizes the caller against the URL channel, but the underlying thread lookup loads the thread parent by id and returns it without verifying the parent belongs to that channel. By requesting a thread in a channel they can access while supplying a victim channel's message id as the …

POST /api/v1/images/edit performed no authorization beyond requiring a verified account. Every other image-editing surface in Open WebUI enforces the global image-edit switch and the per-user image-generation permission — the /api/v1/images/generations route, the built-in edit_image tool, and the chat image-edit middleware — but the direct edit route enforced neither. A verified non-admin user could therefore invoke server-side image editing, reaching the configured image-edit provider with the administrator's credentials, even when the …

Current main and v0.9.6 still allow an authenticated user to turn read-only access to another user's file into write/delete access by attaching that file ID to an attacker-controlled workspace model. This is an incomplete-fix variant of GHSA-vjqm-6gcc-62cr. The current fix adds _verify_knowledge_file_access(), but the validator only checks has_access_to_file(file_id, "read", user). The file write/delete routes later trust has_access_to_file(file_id, "write", user), and that function grants access through any writable model whose meta.knowledge …

The get_all_models handlers in routers/openai.py and routers/ollama.py intended to cache their permission-filtered model lists per user, but the @cached decorator was misconfigured: it passed a key= lambda instead of key_builder=. In aiocache 0.12.3 (the pinned version), key= is a static cache key — a callable passed there is used as a constant object, not invoked per call. As a result the per-user key was never computed, and all callers collided …

An authenticated low-privilege user can execute arbitrary code-interpreter Python and tools inside another user's authenticated session. The Socket.IO event-caller (get_event_call) delivers execute:python / execute:tool events to a client-supplied session_id after only checking that the session is connected, never that it belongs to the requester. Combined with ydoc:document:join, which exposes the live socket ids of everyone in a shared note's collaboration room to any read-access participant, an attacker can target a …

Any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a chat completion request with a channel:-prefixed chat_id and a target message_id. The channel: path routes pipeline output through _make_channel_emitter, which writes to the Messages table using the caller-supplied message_id without binding it to the channel. This advisory consolidates two filings of the same flaw: …

An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected underlying model. The task routes call utils.chat.generate_chat_completion() directly. In that direct path, arena fallback resolution happens after the wrapper access check and then recurses with bypass_filter=True, skipping the selected …

The /api/v1/auths/signin endpoint leaked whether an email address belonged to a registered account through a response-time side channel. Password verification ran bcrypt only when the email was found in the database; for a non-existent email the request returned early without hashing. The expensive bcrypt comparison therefore made valid-account attempts respond significantly slower (~180 ms) than non-existent ones (~5 ms), so an unauthenticated attacker could enumerate valid accounts by measuring response …

The administrator-configured WEB_FETCH_FILTER_LIST (the allow/block list applied to server-side web fetches: RAG URL ingestion, URL-to-markdown, web-search content fetch) matches hostnames incorrectly, so the filter can be bypassed.

The channel members endpoint serializes and returns full user models for channel participants, including settings objects. A normal user in a DM can retrieve admin-only sensitive configuration such as webhook URLs and tool server key material (settings.ui.toolServers[].key), which is not available via standard user info APIs.

Heap-buffer-overflow READ (16 bytes) in Gemm_7_6::adapt_gemm_7_6() (onnx/version_converter/adapters/gemm_7_6.h:41) when ConvertVersion() processes a model with a Gemm node whose input tensors have fewer than 2 dimensions. The adapter accesses B_shape[1] without checking rank. On Release builds the OOB read is silent; ASan confirms 16-byte read past a 48-byte allocation.

1. Forged combined-resource IDs CombinedResourceInfo accepts a path-derived ID without an authenticity check, inflates it without an output limit, converts it to attacker-selected resource identifiers, and retains unique IDs in an unbounded static cache. In bounded tests, 20,754 encoded bytes inflated to 16,000,000 characters (about 770:1; about 49 MB observed heap delta), and 200 unique IDs added 200 permanent cache entries. A legitimately shaped short ID remained about 1:1, while …

Oh My Posh renders dynamic, potentially attacker-controlled strings (the current directory name, Git commit metadata, environment variable values, command output) into the prompt without neutralizing raw terminal control characters. An attacker who controls one of these values can inject ANSI/OSC escape sequences that the victim's terminal executes on every prompt render. (This is separate from the path-segment command-execution report; it has a different root cause and fix.)

Oh My Posh re-renders the resolved path string, which contains the raw folder names taken from the filesystem, through the Go text/template engine. That engine's function map exposes a cmd function that runs arbitrary OS commands. A directory whose name contains a Go template expression is therefore evaluated when the prompt renders, giving arbitrary command execution as the current user as soon as the shell is inside (or below) that …

node-tar (npm tar) contains an uncontrolled-recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. When a consumer calls tar.t(…) or tar.x(…) with a non-empty member-selection list, node-tar installs a filter that closes over the recursive mapHas (src/list.ts:33-44). mapHas walks an entry path upward one path.dirname() call per recursion with no segment cap. A single crafted tar with a GNU-L (or PAX-x) long-path header can deliver a path of …

A memory leak can be caused in Netty's DNS codec by sending malicious DNS packets containing invalid domain names. Because the leak occurs incrementally per packet, sustained malicious requests will cause a gradual Denial of Service.

An attacker can cause Denial of Service by sending a specially crafted malicious XML payload (e.g., repeated </ characters) to a Netty server utilizing XmlFrameDecoder, causing the server's EventLoop thread to exhaust CPU resources and become unresponsive.

What kind of vulnerability is it? Who is impacted? Prototype pollution in update casting: passing a user-controlled update to a Mongoose update, like MyModel.updateOne(filter, req.body), can cause Mongoose to set $fullPath and $parentSchemaDocArray on Object.prototype. Example: const mongoose = require('mongoose'); console.log('before:', Object.prototype.$fullPath); // undefined const User = mongoose.model('User', new mongoose.Schema({ name: String })); const malicious = JSON.parse('{"$set": {"proto.x": "anything"}}'); // attacker-controlled update const q = User.updateOne({}, {}); try { q._castUpdate(malicious); …

Kiota versions prior to 1.32.3 are affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients.

Kiota versions prior to 1.32.3 are affected by a code-generation injection vulnerability in the C# XML documentation-comment sink (the description, externalDocs label, and externalDocs link fields emitted as /// … comments). When text from an OpenAPI description is written into single-line XML doc comments without stripping newline and Unicode line-terminator characters, an attacker can break out of the /// comment line and inject additional code into generated C# clients.

kiota plugin add / kiota plugin generate (with -t APIPlugin) emits an attacker-controlled static_template.file path from the AI-plugin extensions (x-ai-adaptive-card, x-ai-capabilities) verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (<name>-apiplugin.json). An attacker-controlled or compromised OpenAPI description can therefore embed a ../ / absolute path into the manifest's response_semantics.static_template.file, yielding a path traversal (CWE-22) / out-of-package file inclusion (CWE-829) that is resolved by the …

kiota plugin add / kiota plugin generate (with -t APIPlugin) emits an attacker-controlled static_template.file path from the AI-plugin extensions (x-ai-adaptive-card, x-ai-capabilities) verbatim, with no path validation, into the generated Microsoft 365 Copilot / Teams plugin manifest (<name>-apiplugin.json). An attacker-controlled or compromised OpenAPI description can therefore embed a ../ / absolute path into the manifest's response_semantics.static_template.file, yielding a path traversal (CWE-22) / out-of-package file inclusion (CWE-829) that is resolved by the …

Kiota generates AI plugin manifests from an OpenAPI description. When the description contains an x-ai-capabilities response semantics static_template (or the adaptive-card extension x-ai-adaptive-card), the file reference is written into the generated manifest's response_semantics.static_template.file and is later resolved by the AI host relative to the plugin package. An attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package …

Microsoft Kiota resolved OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on 1.32.3 / 1.32.4.

Microsoft Kiota resolved OpenAPI $refs by fetching remote http(s) URLs and reading local files (including absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running kiota generate on a spec whose $ref pointed at an attacker/internal URL or an arbitrary local file yielded SSRF, remote file inclusion, and local file inclusion. Verified on 1.32.3 / 1.32.4.

kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand (and dependency name/version) as the tool's own recommended install command, replacing kiota's normally-trusted suggestion. With an attacker-controlled or compromised description: $ kiota info -d <attacker-spec> -l CSharp … Hint: use the install command to install the dependencies. Example: curl …

kiota info — the command developers run to learn which packages to install after generating a client — read the x-ms-kiota-info extension from the OpenAPI description and presented the spec-supplied dependencyInstallCommand (and dependency name/version) as the tool's own recommended install command, replacing kiota's normally-trusted suggestion. With an attacker-controlled or compromised description: $ kiota info -d <attacker-spec> -l CSharp … Hint: use the install command to install the dependencies. Example: curl …

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution

Code Generation Literal Injection in Kiota Ruby Generator Leads to Arbitrary Code Execution

Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module …

Code Generation Literal Injection in Kiota Python Generator Leads to Arbitrary Code Execution at Import Time. The Kiota Python code generator is vulnerable to a code generation literal injection issue when processing malicious or untrusted OpenAPI specifications. Specifically, attacker-controlled enum value descriptions from x-ms-enum.values[].description can flow into generated Python files without newline sanitization, allowing injected content to escape a comment context and execute at module scope when the generated module …

The Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields (e.g. description, default values, and property names) directly into PHP double-quoted string literals without properly escaping the $ character. Since PHP evaluates string interpolation expressions like "${expr}", "$var", and "{$obj->prop}" within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary PHP code …

The Kiota PHP code generator is vulnerable to a code generation literal injection attack. The generator embeds string values from OpenAPI fields (e.g. description, default values, and property names) directly into PHP double-quoted string literals without properly escaping the $ character. Since PHP evaluates string interpolation expressions like "${expr}", "$var", and "{$obj->prop}" within double-quoted strings at runtime, an attacker who controls an OpenAPI specification file can inject arbitrary PHP code …

Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/–class-name — the zero-config workflow that x-ms-kiota-info is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with …

Microsoft Kiota emitted the x-ms-kiota-info extension's clientClassName or clientNamespaceName value raw, with no identifier or path sanitization, as both the generated client's class/namespace name and part of the generated output path. When kiota generate is run without -c/–class-name — the zero-config workflow that x-ms-kiota-info is explicitly designed for (the API provider supplies the names in the description so consumers don't have to) — an attacker who controls or tampers with …

Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository (or pull request) containing a malicious per-client / per-plugin outputPath causes Kiota, when a developer or CI runs the documented regenerate command, to (CWE-22) write the entire generated client to an arbitrary path outside the workspace — …

Microsoft Kiota honors a poisoned .kiota/workspace.json — the workspace configuration that Kiota's documented team workflow has developers commit to their repository — unvalidated on kiota client generate / kiota plugin generate. A repository (or pull request) containing a malicious per-client / per-plugin outputPath causes Kiota, when a developer or CI runs the documented regenerate command, to (CWE-22) write the entire generated client to an arbitrary path outside the workspace — …

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte array object or the off / len arguments passed to affected XXHash APIs. It does not affect the common case where only the contents of a …

Insufficient validation of byte array arguments in JNI-based XXHash implementations in lz4-java 1.11.0 and earlier allows callers to crash the JVM by passing an invalid array reference or invalid range to native XXHash methods. This affects applications where an attacker can influence the byte array object or the off / len arguments passed to affected XXHash APIs. It does not affect the common case where only the contents of a …

The pop array filter at src/filters/array.ts:91-95 allocates a full clone of its input array via […toArray(v)] but does not call this.context.memoryLimit.use(…) the way every other array-clone filter in the same file does (shift, unshift, compact, concat, reverse, sample, slice, map, sortBy, where, group_by, uniq). This silently disables the memoryLimit budget for {{ huge_array | pop }}, letting a template render allocate an O(N) clone of an attacker-influenced array regardless of …

The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop to block indefinitely. This affects the default new_host() configuration and requires no special setup on either side.

Kite versions 0.6.9 through 0.14.0 authorize Kubernetes proxy requests against the pod or service identified by the original route parameters. Encoded path traversal segments can cause the upstream URL to resolve to a different Kubernetes API endpoint after authorization.

ValidationHandler.Load() in getkin/kin-openapi silently replaces a nil AuthenticationFunc with NoopAuthenticationFunc, which always returns nil without performing any credential check. Because this substitution happens unconditionally when the caller omits the field, every OpenAPI security requirement declared in the spec is silently satisfied for unauthenticated requests. An unauthenticated remote attacker can reach handlers for routes whose OpenAPI operation requires an API key, OAuth token, or any other security scheme if the application …

openapi3filter.ValidateRequest contains a NULL-pointer-dereference denial of service: any unauthenticated client can crash the request-validation path with a single HTTP request. When an operation declares a content parameter (as opposed to a schema parameter) whose media type object has no schema, request validation dereferences that missing schema and panics. The document is legal under the OpenAPI Specification — kin-openapi's own doc.Validate() accepts it — and the defect affects both OpenAPI 3.0.x …

Parsing a small YAML document can take exponential time. An application that calls load() or loadAll() on untrusted input can be hung by a payload under 200 bytes.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When the freetype initialization fails the method does not exit and uses memory that was freed.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When a memory allocation fails inside the FormatMagickCaption method a dangling pointer still points to the freed memory.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

When identifying an image with a crafted 8BIM profile with a specific format string a use-after-free will occur.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

A missing depth check in the MVG decoder will result in a stack overflow when a crafted image is provided.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

Matrix bases operations like -canny are missing a check for allowed memory allocation that could result allocating more memory than allowed.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -script operation is missing policy checks and that could result in both reading from paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

The -concatenate operation is missing policy checks and that could result in both reading and writing to paths disallowed by the security policy.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

Due to a missing check in the APNG encoder and external delegates it is possibly to bypass the policy and write to a disallowed path.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

An incomplete fix of CVE-2026-49219 could result in a policy bypass.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

A memory leak will occur when a blob cannot be opened in the YUV decoder.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

When an allocation fails in the VIFF encoder a memory leak will occus.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

An invalid tiff:tile-geometry will cause a memory leak in the TIFF encoder.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When an allocation fails in the TIFF encoder a small memory leak will occur.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

When a temporary file can not be created a small memory leak will happen in the TIFF encoder.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

A memory leak will occur in the MIFF encoder when an allocation fails.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

When a blob can not be opened a memory leak will occur when encoding a JNG file.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

A memory leak will occur in the ICON decoder when an allocation fails.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When a specific operation fails in the hough lines operation a small memory leak will occur.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When transforming an image to the log colorspace a small memory leak happens when the operation fails.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When processing an extremely large JNX file on 32-bit platforms an integer overflow will happen that can cause a heap buffer over-write.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.

When a profile is displayed with the identify command and the value is not printable a single byte at the end of the profile can be printed.