CVE Vulnerability Catalog

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

This CVE ID has been rejected as a duplicate. All users should reference CVE-2026-33626 instead.

A SQL injection vulnerability exists in MailData Email Archiving System v4.2 and earlier. Technical details are not provided in the description.

Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the vulnerable component, executes arbitrary JavaScript in the security context of that site.

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript in the file server/internal/machine/api/machine_script.go of the Machine Script Feature component. The manipulation of the argument params results in OS command injection. The attack can be executed remotely, and the exploit is now public. Exploitation needs no admin account — any account holding machine:script:run plus tag access reaches arbitrary command execution on machines whose templates contain {{.param}} placeholders. The vendor did not respond to the disclosure.

AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 on Python 3.7 and later has improper certificate validation with host mismatch in the MQTT client TLS connection layer. An adversary-in-the-middle can impersonate the AWS IoT Core endpoint, read telemetry, and inject arbitrary MQTT messages.

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information (if in use) such as passwords and AWS secure access keys. This may lead to unauthorized access to protected resources.

Applications built on MongoDB Entity Framework Core Provider which place a database name in the connection string may inadvertently disable field level encryption. This may lead to protected fields being stored unencrypted.

Applications built on MongoDB Entity Framework Core Provider which combine independent encryption settings and this provider's encryption settings may silently lose TLS and schema-map settings leading to protected fields being stored unencrypted in the database.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical vulnerability details are available.

The NetBox Device Type Library contains a deserialization vulnerability in its test harness, which loads pull-request-controlled pickle files. An unauthenticated contributor can supply a crafted pickle file, leading to arbitrary code execution when pytest runs in GitHub Actions or in a maintainer's process.

In Valhalla (an open source routing engine for OpenStreetMap data) version 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points causes unbounded memory growth in the worker. The zero-area geometry triggers processing in src/loki/polygon_search.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can stop a public-facing worker.

In SAIL before version 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row that the destination buffer cannot hold, resulting in a forward heap overwrite that scales with image height. The issue is fixed in version 1.0.0.

SAIL library version 0.9.10 and earlier contains a mode/depth mismatch when loading Bitmap-mode PSD files. psd_private_sail_pixel_format() returns a one-bit format while the loader accepts depth 8, causing out-of-bounds heap writes that lead to memory corruption, crashes, or potential code execution.

SAIL library version 0.9.10 and earlier contains an incomplete fix for CVE-2026-40494 in the TGA_INDEXED_RLE path. The image buffer is allocated as one byte per pixel, but the loader derives a wider pixel size from an attacker-controlled bpp value, leading to out-of-bounds heap writes and memory corruption.

Obsidian Web MCP prior to 0.2.0 allows an unauthenticated remote attacker to obtain an authorization code without login and exchange it for the static VAULT_MCP_TOKEN. This grants full access to vault operations including read, write, search, move, and delete.

In the OmniBlocks project, the GitHub Actions workflow disc.yml ran on the issues opened and issues edited events and invoked the createDiscussion mutation whenever an issue was classified as off-topic, without recording that the issue had already been converted. A user could repeatedly edit the description of a single off-topic issue before conversion completed, causing multiple discussions to be created for the same issue. The issue is fixed with commit 627e0f0a16a7d74b09128106b57dd7e85d2545df.

OpenFeature Operator version 0.9.2 and earlier allows a tenant who can create a controller-owned workload to use the openfeature.dev/featureflagsource annotation with NAMESPACE/NAME syntax to reference a FeatureFlagSource or InProcessConfiguration in another namespace. On multi-tenant clusters, the cluster-scoped operator reads that resource and materializes spec.envVars literal values, spec.httpSyncBearerToken, sync URIs, and supporting ConfigMaps into the tenant's workload. Single-tenant clusters are not impacted, and secretKeyRef and configMapKeyRef values remain namespace-local.

In Pomerium (an identity and context-aware access proxy) before version 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. The issue is fixed in version 0.32.8.