CVE Vulnerability Catalog

NSauditor 3.1.2.0 contains a buffer overflow vulnerability in the SNMP Auditor Community field, allowing local attackers to crash the application by supplying an excessively long string. Attackers can paste a large payload into the Community field and trigger the Walk function to cause a denial of service condition.

Vulnerability in jetAudio 8.1.7.20702 Basic allows local attackers to crash the application by supplying an excessively long string through the URL input handler. Attackers can trigger the crash by pasting a buffer of 5000 characters into the Open URL dialog, causing the application to terminate abnormally.

A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. It affects an unknown function of the BLE Interface and leads to missing authentication. The attack can only be initiated within the local network and is characterized by high complexity and difficult exploitability. The vendor was contacted but did not respond.

NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste a buffer of 100,000 characters into the email field during login to trigger an application crash.

MediaMonkey 4.1.23 contains a denial of service vulnerability that allows local attackers to crash the application by opening a specially crafted MP3 file containing an excessively long URL string. Attackers can create a malicious MP3 file with a buffer containing 4000 bytes of data appended to a URL, which causes the application to crash when the file is opened through the File > Open URL dialog.

BlueStacks 4.80.0.1060 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to the search field. Attackers can paste a buffer of 100,000 'A' characters into the search field and trigger a search operation to cause the application to crash.

The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting loopback/proxy heuristics.

Nhost to otwarte źródło alternatywy dla Firebase z GraphQL. Przed wersją 0.12.0, obsługa przesyłania plików w usłudze przechowywania ufała nagłówkowi Content-Type dostarczonemu przez klienta, nie wykonując detekcji typu MIME po stronie serwera. To pozwalało atakującemu na przesyłanie plików z dowolnym typem MIME, omijając wszelkie ograniczenia oparte na typie MIME skonfigurowane na zasobnikach przechowywania.

A vulnerability in the GNU C Library (glibc) versions 2.34 through 2.43 causes calls to gethostbyaddr or gethostbyaddr_r with a configured nsswitch.conf specifying the DNS backend to return an invalid DNS hostname, violating the DNS specification.

An XSS vulnerability in SyncFusion 30.1.37 allows injection of malicious JavaScript code via the Document-Editor reply to comment field and the Chat-UI chat message.

A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. A remote attacker with an administrator account can exploit this vulnerability to bypass security mechanisms or read application data.

A vulnerability in Traefik allows bypassing mutual TLS (mTLS) authentication by sending a fragmented ClientHello packet. When SNI extraction fails due to fragmentation, the TCP router falls back to the default TLS configuration, which does not require client certificates.

Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite allows Object Injection. This issue affects TotalContest Lite from n/a through 2.9.1.

In the Linux kernel, a NULL pointer dereference vulnerability was found in the TEQL (Trivial Equalizer) network scheduler. The teql_master_xmit() function fails to update skb->dev before calling netdev_start_xmit(), causing gretap tunnels to use the wrong master device teql0 which lacks allocated tstats, resulting in a page fault.

Memory Allocation with Excessive Size Value (CWE-789) in the Prometheus remote_write HTTP handler in Metricbeat can lead to Denial of Service via Excessive Allocation (CAPEC-130).

A flaw was found in libarchive related to undefined behavior in the zisofs decompression logic, caused by improper validation of the `pz_log2_bs` field read from ISO9660 Rock Ridge extensions. A remote attacker can exploit this by supplying a specially crafted ISO file, leading to incorrect memory allocation and potential application crashes, resulting in a denial-of-service (DoS) condition.

A reflected XSS vulnerability in the Location Aware Sensor System by Linkit ONE (up to commit f06bd20, 2023-04-26) exists in the PM25.php file. Attackers can inject malicious JavaScript into GET parameters (site, city, district, channel, apikey), leading to script execution in victims' browsers.

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the externalfeed/RSS API component that allows authenticated attackers to trigger arbitrary outbound requests from the server. Attackers can exploit insufficient validation of externally supplied resource references to interact with internal services or cause resource exhaustion impacting availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

BMC FootPrints ITSM versions 20.20.02 through 20.24.01.001 contain a blind server-side request forgery vulnerability in the searchWeb API component that allows authenticated attackers to cause the server to initiate arbitrary outbound requests. Attackers can exploit improper URL validation to perform internal network scanning or interact with internal services, impacting system availability. The following hotfixes remediate the vulnerability: 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, and 20.24.01.

W jądrze systemu Linux rozwiązano problem z niespójnością flagi IS_CHECKPOINTED, który występował podczas równoczesnych operacji zapisu atomowego i checkpointu w systemie plików F2FS. Problem objawiał się błędem -EINVAL podczas montowania F2FS w określonych warunkach wielowątkowych.