AISLE CVE Discoveries

Command injection via shell metacharacters in filenames with the CLI -c/--cmd option

Memory leak converting X.509 certificate fields in socket.getPeerCertificate(true)

Integer overflow in the mod_md ACME renewal backoff leading to delay-free retries

Out-of-bounds read and integer underflow in the GLib remote inspector server

Incorrect boundary conditions in the JavaScript WebAssembly component

Out-of-bounds read and write in RFC 3211 KEK unwrap when decrypting CMS messages

OCSP designated-responder authorization bypass via missing signature verification

Known-host key type mismatch silently accepted via the CURLOPT_SSH_KEYFUNCTION callback

Name constraints bypass via case-sensitive dNSName and rfc822Name comparison

Out-of-bounds write in PKCS12_get_friendlyname() UTF-8 conversion

Memory corruption from uncanceled AIO requests in the one-shot AIO error path

Stored XSS in the Inventory Report via unescaped option labels in selectForm()

Stored XSS in the Host Management page via the unauthenticated inventory endpoint

Unbounded resource allocation in mod_md when processing OCSP response data

allowFrom allowlist bypass in the Twitch plugin when allowedRoles is empty

Use-after-free when curl_easy_pause() is called from the socket callback

FFmpeg Out-of-Bounds Read in AV1 RTP Packetizer via rtpenc_av1.c

Symlink-following chown allows local privilege escalation via pid file path manipulation

Consecutive topic wildcards cause combinatorial routing work

Missing authorization in the submissions-table block exposes form submissions to visitors

Out-of-bounds read in the S/PDIF muxer via an oversized DTS core_size value

SQL injection during profile field migration via user-supplied profile field data

IDOR in the DICOM viewer state API allows reading or modifying any document's state

IDOR in the portal payment page via a user-supplied pid parameter

SSRF and private network restriction bypass via numeric IP destinations

Heap buffer over-read in png_image_finish_read when reading interlaced 16-bit PNGs

Owner-scope role restrictions not enforced on API v2 endpoints, exposing other users' data

Out-of-bounds read in audit_compare_dname_path() when watching the root directory

Out-of-bounds read and write in batman-adv network-coding decode

Double free in parse_def() when parsing nested compound configuration blocks

Command injection in rpmuncompress via an archive's top-level directory name

Non-atomic JSON Patch application destroys target document members on failed operations

Validation bypass via client-controlled field metadata in the AJAX submission handler

Out-of-bounds read when parsing JPEG headers for the ESP32-P4 hardware decoder

Missing authentication on the Nostr plugin's profile HTTP endpoints

Symlink following in group-writable token directories leading to privilege escalation

XSS via stack traces rendered as raw HTML in the Explore Traces view

Unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

Heap buffer overflow in C_WrapKey with CKM_ECDH_AES_KEY_WRAP via compressed EC keys

Out-of-bounds write in BLF file parsing

Null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

IV reuse across chunks in one-shot symmetric cipher operations on large inputs

Stack out-of-bounds read in s_vlog() when handling oversized log messages

Out-of-bounds read in sh_disassemble when disassembling crafted SH2A bytecode

Heap buffer overflow in set_reg_n when disassembling crafted SH2A FPU bytecode

Inverted IP SubjectAltName comparison in the OpenSSL backend skips authenticity checks

Permission check bypass in channelUpdate via all([]) lets anonymous users modify channels

Out-of-bounds read parsing FTP directory listings leaks memory from other transactions