CVE Vulnerability Catalog

In Netdata prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent.

Netdata prior to 2.11.0 contains a vulnerability in the unauthenticated WebSocket server that allows an attacker to send small highly compressed frames, leading to large server-side allocations and causing memory exhaustion and termination of monitoring.

Netdata from 2.0.0 to 2.10.4 contains a vulnerability during MSI repair where powershell.exe runs as SYSTEM without -NoProfile and loads the user's PowerShell profile, allowing commands placed in that profile to execute with SYSTEM privileges.

This CVE entry has been rejected. Further research determined the issue results from a dependency.

In Nuclei from 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go can evaluate substituted runtime data more than once, creating a second evaluation pass that allows response content captured by an internal extractor to be reinterpreted as template syntax. When -env-vars is enabled, a malicious scan target can return marker-shaped content that discloses scanner-host environment variables such as credentials, API keys, or tokens.

In Nuclei from 3.0.0 until 3.10.0, the workflow template loading path does not enforce the -file capability gate when resolving file: protocol templates referenced by a workflow. An untrusted unsigned workflow can therefore load a file-protocol template and read local files from the scanner host even when the operator has not enabled file templates.

In Nuclei from 3.0.0 until 3.10.0, the nuclei/mysql JavaScript library does not enforce the local-file sandbox when a JavaScript template supplies the allowAllFiles MySQL DSN option. An untrusted javascript: template scanning an attacker-controlled MySQL-compatible endpoint can cause the server to issue LOAD DATA LOCAL INFILE requests for arbitrary paths, after which the scanner's MySQL client reads the files and returns their contents to the server even though -allow-local-file-access is disabled.

In Nuclei from 3.0.0 until 3.10.0, the DAST template loading branch does not apply the unsigned code-template signature check before accepting a template that contains both a fuzzing: block and an unsigned code: block. When an operator enables -dast, an untrusted multiprotocol template can place an unsigned code request into the execution queue and run arbitrary shell commands even without -code or a valid cryptographic signature.

In 9Router prior to 0.5.6, deployments that allow requests to reach Next.js without the sanitizing custom-server.js wrapper use the client-supplied X-9r-Real-Ip value as the bucket key in getClientIp, checkLock, and recordFail in src/lib/auth/loginLimiter.js for POST /api/auth/login. A remote unauthenticated attacker can rotate the header on every password guess so each request uses a new failed-attempt bucket and the five-attempt progressive lockout never returns HTTP 429.

This CVE was rejected because it was reserved in error and duplicates CVE-2026-89530.

MISP registers PHP's phar stream wrapper in both its web and console entry points. This causes filesystem operations on caller-influenced paths to trigger implicit unserialize() (a deserialization sink), and a relocated application root can reach executable code inside an uploaded phar file, enabling code execution as the web user.

A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the permission string 'theming_enabled*' (with a trailing asterisk) instead of the correct 'theming_enabled'. The malformed key does not match any valid permission identifier, causing the access control check for previewEventAttributes to malfunction — potentially resulting in either an authorization bypass or denial of access for legitimate users.

Aureus ERP before 1.5.0 fails to scope message lookups to the current record in ChatterPanel, allowing authenticated users to access arbitrary messages. Attackers can submit sequential message IDs to read, edit, delete, or pin messages from other departments or companies, and enumerate all notes in the system.

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded invitation link can load the page while pending, then accept the invitation after the legitimate user has already accepted it to overwrite the account password and gain authenticated access to managed database credentials and secrets.

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC statistics in unbounded in-memory lists, leading to persistent memory growth and increased CPU usage.

Dark Reader before version 4.9.126 (for Firefox) or 4.9.128 (for other browsers) allows a website to trigger a request to a locally running server through the image inversion pipeline when a resource uses a known public HTTPS URL and is detected as requiring inversion. This can cross the website-to-local-network boundary and disclose limited information about the resource.

In SSSD configured with the LDAP access provider and ldap_access_order including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user.

In Traefik from 3.6.11 until 3.7.13, checkPassword in BasicAuth constructs the singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames coalesce on one key while configured usernames perform separate password hashes, creating an unauthenticated timing discrepancy that reveals whether a username exists. Sequential checks remain cost-equalized, Traefik v2 and Digest authentication are not affected, and the issue does not disclose credentials or bypass authentication.

A time-of-check to time-of-use (TOCTOU) race condition in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs, glibc validates the lexically normalized search path against trusted directories but then opens the raw, un-normalized path. On systems where the Linux fs.protected_hardlinks sysctl is disabled, a local attacker who hard-links such a program into an attacker-controlled directory and wins a race to replace an intermediate path component with a symbolic link can direct the loader outside the trusted directory, causing it to load an attacker-controlled shared object and execute arbitrary code with the elevated privileges of the program.