CVE Vulnerability Catalog

An issue was discovered in DD-WRT before version 45724 in router/upnp/src/ssdp.c. An unsafe strcpy in UPnP handling allows an unauthenticated remote attacker to overflow an internal fixed buffer via an M-SEARCH request. Exploitation requires UPnP to be enabled (disabled by default, listening only on internal interfaces).

A post-authentication improper control of generation of code (Code Injection) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC). Under specific conditions, it could allow a remote authenticated attacker with administrator privileges to execute arbitrary OS commands.

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended locations.

A vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over the network due to weak authentication.

A deserialization of untrusted data vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to execute code remotely over a network.

Missing authentication for a critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

Deserialization of untrusted data vulnerability in Microsoft Office SharePoint. An unauthenticated attacker can remotely execute code on the SharePoint server.

The Balbooa Forms extension for Joomla versions below 2.4.1 contains a vulnerability allowing an unauthenticated attacker to upload arbitrary files, including executable files. This leads to full remote code execution (RCE).

LiteLLM before version 1.84.0 has a vulnerability in the MCP Streamable HTTP endpoint that allows an unauthenticated attacker to bypass LiteLLM key validation using a crafted Authorization header. The attacker can exploit the OAuth2 passthrough fallback path to replace failed key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid key.

In the Linux kernel's __ip6_append_data() function for IPv6, a bug was found in the buffer size calculation for the paged allocation path. Incorrect accounting of fraggap (extra bytes carried over between packets) causes the linear area of the skb to be undersized, leading to data being copied past its end and overwriting skb_shared_info structures. An unprivileged user can trigger this via a UDPv6 socket with MSG_MORE and MSG_SPLICE_PAGES flags.

A Path Traversal vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier allows a remote attacker to execute arbitrary code in the context of the current user without requiring user interaction. The issue stems from improper limitation of a pathname to a restricted directory.

A memory overflow vulnerability in NetScaler ADC and NetScaler Gateway can lead to unpredictable or erroneous behavior and Denial of Service (DoS) if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

The Page Builder CK extension for Joomla versions below 3.6.0 contains a vulnerability allowing an unauthenticated attacker to upload arbitrary files, including executable files. This leads to full remote code execution (RCE).

In Kestra OSS prior to versions 1.0.45 and 1.3.21, the AuthenticationFilter uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials.

A vulnerability was found in the Linux kernel's netfilter bridge module, specifically in the ebt_snat target. The skb_store_bits() function writing the ARP sender hardware address may operate on nonlinear skb fragments, leading to writes in unintended memory areas. Lack of writeability check before the operation can cause data corruption.

In Langflow prior to 1.9.1, an IDOR vulnerability in the /api/v1/responses endpoint allows an authenticated attacker to execute any flow belonging to another user by specifying the victim's flow ID in the request.

A vulnerability in the iCagenda extension for Joomla allows arbitrary file upload in the file attachment feature, leading to PHP code upload and execution.

A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

A critical remote code execution (RCE) vulnerability in PTC Windchill PDMlink and PTC FlexPLM. The flaw can be exploited via deserialization of untrusted data, allowing an attacker to execute arbitrary code remotely.