CVE Vulnerability Catalog

Cloudflare quiche was found vulnerable to memory resource exhaustion due to unbounded queuing of post-handshake client migration events. An attacker can exploit rapid source address migration to cause unbounded queuing of PathEvent::ReusedSourceConnectionId events, even if active connection migration is disabled.

A denial-of-service vulnerability in the product arises from improper handling of exceptions when processing crafted CIP packets sent to the adapter. A power cycle is required to recover the module and associated I/O.

Cloudflare quiche's HTTP/3 layer is vulnerable to resource exhaustion (memory) via specially crafted HTTP/3 frames. Pre-allocation of memory based on declared frame length can be triggered without sending the full payload. Additionally, incorrect QPACK decompression limits allow memory commitment beyond advertised MAX_FIELD_SECTION_SIZE.

A path traversal vulnerability exists in Rockwell Automation ThinManager® software due to improper limitation of file save operations within the API. An authenticated attacker could exploit this to write arbitrary files to restricted system directories outside the intended application directory.

A vulnerability in Sonatype Nexus Repository Manager allows a remote attacker to gain unauthorized access to repository operations as a targeted user. Exploitation requires enabling a format-specific API key realm (NuGet API Key, Docker Bearer Token, or npm Bearer Token) and the targeted user having an active API key.

An out-of-bounds read vulnerability in Fortinet FortiAuthenticator versions 6.6.0 through 6.6.2 and all versions of 6.5 may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request.

A denial-of-service vulnerability in 1756-EN2, EN3, and ENBT communication modules stems from improper validation of CIP Implicit Connection packets. An attacker on the network can send crafted packets to continuously disrupt device connections, which recover immediately afterward.

A denial-of-service vulnerability exists in the 1719-AENTR due to improper handling of a UDP unicast network storm. This causes device overload and communication loss, requiring a power cycle to recover.

A vulnerability in Spotfire Enterprise, Spotfire Enterprise with External Consumers, and Spotfire on Kubernetes allows an attacker to perform a buffer overflow or arbitrary code execution. The issue affects multiple versions of Spotfire Server modules.

Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory.

The Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to sensitive values such as the passphrase and listening port, and can also achieve the same result through cross-site request forgery due to the absence of adequate request validation.

A CSRF vulnerability in Sustainable Irrigation Platform (SIP) through version 5.2.16 allows remote attackers to perform state-changing administrative actions by tricking a logged-in administrator into visiting a malicious page that issues HTTP GET requests without CSRF token validation or origin verification. The default configuration (no passphrase, default credential 'opendoor') exposes these endpoints to unauthenticated users.

A buffer overflow vulnerability has been discovered in aMule version 2.3.3. A remote attacker can exploit this flaw by sending a specially crafted message to the OP_SERVERMESSAGE Handler, causing the application to crash and resulting in a denial of service.

Snowflake SQLAlchemy versions prior to 1.11.0 contain multiple vulnerabilities: improper handling of column identifiers in MERGE operations allows SQL injection via attacker-controlled keys; improper literal rendering of bound parameters in CREATE TABLE queries allows SQL injection; improper forwarding of connection configuration parameters allows reading arbitrary local files and transmitting their contents to an attacker.

A stack-based buffer overflow vulnerability has been discovered in the Tenda BE12 Pro device running firmware version 16.03.66.23, specifically in the fromVirtualSer function of the /goform/VirtualSer file. An attacker can remotely manipulate the page argument, causing a buffer overflow. The exploit has been publicly disclosed and may be used.

A stack-based buffer overflow vulnerability has been discovered in Tenda BE12 Pro firmware version 16.03.66.23, specifically in the fromDhcpListClient function of the /goform/DhcpListClient file. An attacker can remotely exploit this flaw by manipulating the page argument, potentially leading to arbitrary code execution.

A stack-based buffer overflow vulnerability was found in Tenda BE12 Pro firmware version 16.03.66.23 in the fromSetIpBind function of the /goform/SetIpBind file. An attacker can remotely exploit this by manipulating the page argument, potentially leading to arbitrary code execution.

A path traversal vulnerability in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root.

A vulnerability in FactoryTalk® Services Platform (FTSP) allows bypassing JWT signature validation during Okta Web Authentication. The application fails to verify that the JWT algorithm is set to RSA, enabling an attacker to set the algorithm to "none" and craft forged tokens.

A vulnerability in the LwM2M library of Zephyr RTOS copies the firmware-update Package URI into a fixed buffer without length validation. An attacker can write a URI of 128-254 characters, causing an out-of-bounds read of adjacent static memory, information disclosure, and potential device crash.