CVE Vulnerability Catalog

In MKP (a Model Context Protocol server for Kubernetes) before version 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource. buildPodLogOpts() in pkg/k8s/subresource.go parses those values as unbounded int64 parameters, and defaultGetPodLogs() copies the returned Kubernetes log stream through io.Copy into an in-memory bytes.Buffer without an application-side cap. The issue is fixed in version 0.4.1.

In Omni (which manages Kubernetes on bare metal, virtual machines, or in a cloud) from 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The issue is fixed in versions 1.6.6 and 1.7.3.

In Omni before versions 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, which url.URL.JoinPath normalizes into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics.

In Omni before 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The issue is fixed in versions 1.6.6 and 1.7.3.

A vulnerability was detected in Dromara mayfly-go up to 1.11.5 in an unknown function of the file server/internal/ai/api/ai.go in the AI Assistant component, leading to missing authorization. Remote exploitation is possible, and the exploit has been publicly disclosed. The whitelist bypass is one-token wide — any compound command containing curl, wget, or sed auto-runs without approval, and approval is granted by the same session user (self-approval).

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.

In Keycloak deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

In uniget (a universal installer and updater for container tools) before version 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. The issue is fixed in version 0.27.6.

In uniget before version 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments.

In punchin-email before version 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass.

GravitLauncher prior to 5.7.12 allows an unauthenticated remote attacker to read arbitrary files from the LaunchServer file server by sending an HTTP request without a leading slash. This exposes signing keys, refresh-token material, and database credentials.

In ESPAsyncWebServer (an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350) before version 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. The issue is fixed in version 3.11.1.

In Frappe HR (an open-source human resources management solution) before version 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. The issue is fixed in 16.7.0.

In MCP Documentation Server from 1.13.0 until 1.13.1, the automatically started Web UI listens on all network interfaces (port 3080) instead of localhost by default. An unauthenticated network client can call API endpoints to enumerate, read, search, insert, and delete documents, and to read configuration, thereby tampering with the MCP assistant's knowledge base. The issue is fixed in 1.13.1.

In the Elixir protobuf library from 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes can be taken offline when the schema contains a self-referential or cyclic message type. The decoder recursively processes nested embedded fields without a nesting-depth limit, allowing a relatively small request to consume substantial CPU and memory and pin a BEAM scheduler. The issue is fixed in 0.16.1.

In TS3 Manager prior to 2.2.6, the /api/download handler passes the attacker-controlled port parameter to socket.connect and returns the error message as text/html without a Content Security Policy. When a logged-in operator follows a crafted link, the reflected script executes in the manager origin, and the token cookie lacking HttpOnly, Secure, and SameSite can be read. This enables operator-session hijacking and control of the managed TeamSpeak server. The issue is fixed in 2.2.6.

In the FaustWP WordPress plugin prior to 1.8.11, only the ciphertext in the token envelope is authenticated, and the 16-byte initialization vector is excluded from the HMAC. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can yield an Administrator access token and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. The issue is fixed in 1.8.11.

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated user with permission to manage groups and request reports can create a cyclic group-parent hierarchy and request a trips or stops report for a device in that hierarchy. GroupResource permits the parent cycle, while AttributeUtil.lookup follows group parents without cycle detection, a visited set, or a depth limit, causing the lookup to never terminate, pinning a Jetty worker at high CPU and potentially exhausting the web/API worker pool when requests are repeated.

In Traccar prior to 6.14.0, an authenticated non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Validation checks only the first two keys, but removePermission() concatenates every map key into the SQL WHERE clause as column identifiers, enabling SQL injection and extraction of arbitrary database values, including administrator email, password hashes, and salts. The issue is fixed in 6.14.0.

In lxc-ci, images built from images/archlinux.yaml prior to the 2026-05-28 Arch Linux image publication retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic can use the shared pacman signing private key to sign modified packages that affected clients accept as trusted. Installing those packages permits arbitrary code execution as root on the client system. The issue is fixed in Arch Linux images published on or after 2026-05-28.