CVE Vulnerability Catalog

node-tar prior to version 7.5.21 has a vulnerability in the filesFilter function in src/list.ts, which uses the recursive mapHas helper to walk an archive entry path without a segment cap. A crafted GNU L or PAX x long-path header with thousands of segments can cause an uncatchable RangeError stack overflow, terminating asynchronous and streaming Node.js consumers. The issue is fixed in version 7.5.21.

frp versions 0.53.0 through 0.70.1 have a vulnerability in the optional SSH Tunnel Gateway in pkg/ssh/server.go, where parsing an SSH exec channel request adds 4 to an attacker-controlled length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeating the bounds check and causing a panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, an unauthenticated peer can reach this phase before the frp token is checked, and a single five-byte request terminates the frps process and drops every active tunnel. The issue is fixed in version 0.70.1.

Hub prior to version 0.2.16 has a vulnerability where every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners, which calls requestClientId and sends a get-client-id action, pushing a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated. Repeated connections cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. The issue is fixed in version 0.2.16.

Rainbond through version 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates.

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC).

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels, forcing a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

SSRF vulnerability in migration asset downloads bypasses hostmatcher, allowing reading internal files and cloud metadata.

SQL injection vulnerability in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis before 2026.1.586 and before 2026.2.592.

Branch protection can be bypassed via PR retargeting, preserving a stale `official` approval flag. This allows changes to be pushed to protected branches without the required approval.

A cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access. There is a lack of proper object-level authorization.

The vulnerability allows manipulation of repository visibility via Git push options. An attacker can change repository visibility (e.g., from private to public) without proper permissions.

ParseAcceptLanguage in the Locale middleware causes a quadratic-time DoS on unauthenticated requests. Sending specially crafted Accept-Language headers can overload the server.

Private repository metadata remains accessible after access revocation. This means that information about the repository (e.g., name, description) may still be visible to users who lost permissions.

The vulnerability leaks the member list of private organizations via the /members API endpoint. This is an incomplete fix for PR #38145.

The vulnerability in the REST API exposes organization membership of private organizations to the public. Unauthorized individuals can obtain information about members of private organizations.

The vulnerability in Fork-PR Actions tasks allows reading a third private repository via the collaborative-owner branch. A missing fork-PR guard enables this.

Two Server-Side Request Forgery (SSRF) findings in Gitea 1.26.2. They allow an attacker to make requests from the server to internal resources.

The vulnerability in repository migration follows Git HTTP redirects after URL allow/block validation, enabling internal Git repository exfiltration.