CVE Vulnerability Catalog

Skipper has an incomplete fix for CVE-2026-50197 where oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence policies. When the request body exceeds the maxBodyBytes limit, Skipper forwards the full payload to the upstream service while OPA evaluates an empty parsed_body, allowing forbidden actions.

9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints, link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.

Google Chrome prior to version 150.0.7871.186 has an out-of-bounds write vulnerability in Codecs. A remote attacker can potentially escape the sandbox via a crafted HTML page.

Google Chrome prior to version 150.0.7871.186 contains a use-after-free vulnerability in the WebMCP component. A remote attacker can exploit a crafted HTML page to execute arbitrary code inside a sandbox. Chromium security severity is High.

Use-after-free vulnerability in the Blink component of Google Chrome prior to version 150.0.7871.186. A remote attacker can execute arbitrary code within a sandbox via a crafted HTML page.

Google Chrome prior to version 150.0.7871.186 has a use-after-free vulnerability in Input. A remote attacker who compromised the renderer process can potentially escape the sandbox via a crafted HTML page.

In the file /OnlineClassroom/loginlinkadmin.php of CodeAstro Online Classroom 1.0, there is an SQL injection vulnerability via the aid argument. The attack can be performed remotely, and the exploit is publicly available.

Cal.com (calcom/cal.diy) through version 4.7.15 has a stored cross-site scripting (XSS) vulnerability in the single booking view (e.g., https://app.cal.com/booking/<id>). Booking-question field labels are rendered via React's dangerouslySetInnerHTML without sanitizing or escaping user input, allowing an attacker to inject arbitrary HTML/JavaScript.

XSS vulnerability in Cal.com (calcom/cal.diy) versions up to 4.7.15. Booking form field labels are rendered via React's dangerouslySetInnerHTML without proper sanitization, allowing injection of arbitrary HTML/JavaScript. Fixed in version 4.7.16.

In the SiWx917 chip, an entropy initialization bug causes the DRBG to use a predictable seed. All random numbers generated in Matter code are identical. The vulnerability was discovered after the repository was deprecated.

A stack-based buffer overflow vulnerability in the affected product, which may allow an attacker to cause memory corruption via a Read Request.

In the MMS Write Named Variable List handler, a NULL pointer dereference may allow a network-adjacent attacker to crash the server by sending a WriteRequest with an empty listOfData field.

The affected product is vulnerable to a heap-based buffer overflow via a crafted MMS Initiate request. Remote code execution (RCE) is possible when ASLR is disabled; memory corruption or denial of service may occur in configurations where ASLR is enabled.

In nebula-mesh before version 0.3.1, standard browser security headers (Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy) are missing in the internal/web/ and internal/api/ response paths. Fixed in version 0.3.1.

A vulnerability in Protegent 360 version 2.0.0.4 by Unistal Systems allows a local attacker to escalate privileges via the kernel driver pgsecdl.sys.

CWE-269 vulnerability in Johnson Controls victor Web on Windows allows CAPEC-233. This issue affects victor Web: before 7.1.

Deserialization of untrusted data vulnerability in Johnson Controls victor, CCure 9000, and Victor Application Server. Allows CAPEC-586 attack.

Johnson Controls CCure 9000 and Victor Application Server versions 2.9 through 3.0 contain a Server-Side Request Forgery (SSRF) vulnerability.

Improper neutralization of argument delimiters in the install_packages() method in AWS Bedrock AgentCore Python SDK before 1.18.1 might allow a remote authenticated user to execute arbitrary commands within the Code Interpreter sandbox via crafted package name arguments.

An out-of-bounds read vulnerability in the product may allow an attacker to crash the parsing process and cause a denial of service.