CVE Vulnerability Catalog

Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.0 before 5.2.*, from 4.1x before 5.1.*.

RTI Connext Professional (Core Libraries) has an Out-of-bounds Read, Function Call With Incorrect Number of Arguments, and Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that allows overread buffers. This affects versions from 7.4.0 before 7.7.0.1, from 7.3.0 before 7.3.1.6, and from 6.1.2.21 before 6.1.*.

Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Professional: from 7.4.0 before 7.7.0.1, from 7.0.0 before 7.3.1.6, from 6.1.0 before 6.1.*, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 5.2.3 before 5.2.*.

RTI Connext Professional (Core Libraries) has an Out-of-bounds Read, Function Call With Incorrect Number of Arguments, and Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that allows overread buffers. This affects versions from 7.4.0 before 7.7.0.1 and from 7.3.0 before 7.3.1.6.

RTI Connext Professional (Core Libraries) has a Double Free vulnerability that allows file manipulation. This affects versions from 7.4.0 before 7.7.0.1 and from 7.1.0 before 7.3.1.6.

A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/', the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory.

Postiz generates security-sensitive credentials using Math.random() instead of a cryptographically secure source. The same helper is used for OAuth access tokens, authorization codes, client secrets, organization API keys, and PKCE verifiers, meaning these credentials depend entirely on V8's deterministic xorshift128+ PRNG state. An unauthenticated OAuth dynamic client registration endpoint exposes freshly generated client credentials, giving attackers enough consecutive PRNG output to reconstruct that internal state and derive past and future values.

An HTTP endpoint intended for provisioning enterprise and reseller organizations is reachable without any session. The authentication middleware is bound only to an explicit list of controllers, and the enterprise controller is not on that list, so no authentication runs for these routes. The only check is that the request body carries a token with a valid signature, but it does not check what the token was issued for, allowing an ordinary user's own session token to pass. This allows creating a new organization with the highest subscription tier and immediate API key.

LightRAG prior to 1.5.5 renders answer and thinking content with react-markdown, rehypeRaw, and skipHtml=false without an HTML sanitizer. An attacker who can add a document can store raw HTML that is returned through the query path and rendered as active content, enabling arbitrary JavaScript execution via elements such as iframe srcdoc. The script runs in the LightRAG WebUI origin and can read the API token from localStorage and perform API actions as the victim.

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintext provider credentials through github.one, gitlab.one, gitea.one, and bitbucket.one because those protected procedures return full provider rows without applying getAccessibleGitProviderIds or an organization check. The application.one route also returns nested GitHub, GitLab, Gitea, and Bitbucket relations from findApplicationById with GitHub App private keys, OAuth tokens, client secrets, webhook secrets, and app passwords even when hasGitProviderAccess is false.

LightRAG prior to 1.5.5 contains a vulnerability in the Markdown parser that allows fetching resources with internal IPv4 addresses using NAT64 translators, potentially leading to unauthorized access to internal resources.

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightrag_server.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full request speed until a valid account password is found.

LightRAG prior to 1.5.5 has verify_password in lightrag/api/passwords.py comparing plaintext AUTH_ACCOUNTS password values with Python's == operator. The comparison can return after the first mismatching byte, creating response-time differences based on password length and matching prefixes. A network attacker with sufficiently low-latency access can repeatedly query /login and use the timing oracle to recover a plaintext-configured password character by character. Deployments using bcrypt-prefixed password values are not affected by this comparison path.

LightRAG prior to 1.5.5 returns raw Python exception text from error handlers in document_routes.py, graph_routes.py, query_routes.py, ollama_api.py, and lightrag_server.py. The detail=str(e), detail=str(exc), and equivalent formatted-message paths expose server filesystem paths, database host, port, user, and database names, language-model provider diagnostics, configuration details, and Python library internals to a network client that can trigger an error. The default unauthenticated configuration makes those responses reachable without credentials.

FastGPT prior to 4.15.2 has a DNS rebinding flaw in the safe Axios request interceptor in packages/service/common/api/axios.ts. The hostname is validated with isInternalAddress() before a later HTTP connection performs an independent DNS lookup, creating a time-of-check/time-of-use gap. An authenticated attacker who can supply a URL to a safe-Axios-backed HTTP tool, workflow HTTP node, external file fetch, or other server-side integration can reach services that direct private-address inputs would block.

Sentry from 23.11.0 to 26.7.0 with relocation feature enabled unsafely deserializes a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes arbitrary code execution in the import worker process.

Netdata prior to 2.10.4 contains a vulnerability in the setuid-root ndsudo helper command fail2ban-client-status-socket which accepts a caller-controlled --socket_path from the low-privileged netdata service account, allowing attacker-controlled code to execute as root on systems with fail2ban-client installed.

In Netdata from 2.0.0 until 2.11.0, the /api/v3/settings endpoint is registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, allowing unauthenticated PUT requests to bypass operator-configured IP allow restrictions. An attacker can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space.

In Netdata prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot without an upper bound. prd_array_create can then wrap the size_t allocation calculation while retaining the original large array size, causing the initialization loop to write beyond the undersized heap allocation and crash the parent agent.