CVE Vulnerability Catalog

In the ESP-IDF Espressif IoT Development Framework, a NULL-pointer dereference exists in the esp_http_server component during WebSocket subprotocol negotiation. The missing NULL check on the tokenization result of the Sec-WebSocket-Protocol header can crash the server before authentication.

In Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers fail to validate all caller-supplied pointer arguments, allowing the REE to read TEE memory. This issue has been fixed in versions 5.5.5 and 6.0.1.

Multiple stack-based buffer overflows in the SimpleBLE library for Bluetooth Low Energy. Vulnerabilities exist in the Protocol::simpleble_write function and during processing of manufacturer and service data in BLE advertisements.

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver. When username compatibility mode is enabled, attackers can manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Metacharacters in @mentions pass through esc_sql unescaped and are inserted into an unprepared REGEXP query, enabling username inference and DoS through catastrophic backtracking.

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API, allowing authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by update and delete handlers, to read, reply to, or delete any user's private messages.

A remote, unauthenticated denial-of-service vulnerability in Nimiq prior to version 1.5.0 allows any state-sync peer to crash any node performing state synchronization via MerkleRadixTrie::put_chunk.

A vulnerability in the Rust implementation of Nimiq before version 1.4.0 causes the DhtResults accumulator in handle_dht_get() to be initialized only after the first DHT record passes verification. If the first record fails (from a malicious node), all subsequent valid records are discarded.

OpenEMR before version 8.0.0.1 contains a stored XSS vulnerability in the prescription CSS/HTML multi-print feature. A patient portal user can inject malicious JavaScript into demographic fields, which executes in the clinician's session, allowing session hijacking and actions as the clinician.

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

SimpleSAMLphp-casserver before version 7.0.3 has a path traversal vulnerability in FileSystemTicketStore. An attacker can use ../ sequences in the ticket identifier to read and unserialize arbitrary files outside the ticket directory, and in CAS 1.0 also delete them.

LMDeploy versions up to 0.12.3 have hardcoded "trust_remote_code=True" in multiple HuggingFace model-loading call sites, allowing arbitrary code execution. No public patches are available at the time of publication.

Cloud Hypervisor versions 21.0 through before 51.2 allow a guest to trigger a use-after-free by submitting two virtio-block descriptor chains with the same head_index while asynchronous block I/O is enabled. Patched in versions 51.2 and 52.0.

In Pipecat, from version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in the development runner. This allows an attacker to access files that the pipecat process has permissions for through a single unauthenticated HTTP request.

A vulnerability in the JsonPulsarHeaderMapper component in Spring for Apache Pulsar causes type header matching against trusted packages to use a prefix check, meaning trusting any package implicitly trusts all its subpackages. Additionally, an empty trusted-packages configuration falls back to trusting all packages instead of a safe default allow-list.

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning trusting any package implicitly trusts all its subpackages. Combined with Jackson's default bean deserialization, a producer can supply crafted header values that cause the consumer to deserialize arbitrary JDK types. Affected versions: Spring for Apache Kafka 4.0.0-4.0.5, 3.3.0-3.3.15, 3.2.0-3.2.13, 2.9.0-2.9.13, 2.8.0-2.8.11.

Vulnerability in Spring Data REST involving SpEL expression injection through map-typed properties when processing JSON Patch requests. The JSON Pointer path segment used as the map key is embedded into a SpEL expression without sanitization. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.

Spring Data REST's JSON Patch implementation does not apply write-access filter to intermediate path segments when resolving a multi-segment JSON Pointer. Affected versions: 3.7.0 through 3.7.19, 4.3.0 through 4.3.16, 4.4.0 through 4.4.14, 4.5.0 through 4.5.11, and 5.0.0 through 5.0.5.

SpEL expression injection vulnerability in Spring Data MongoDB. Occurs during parameter binding in repository query methods annotated with @Query using a wildcard placeholder.

Vulnerability in Spring Data Commons causes the internal property-lookup cache to accept and permanently store attacker-supplied strings as keys, leading to heap exhaustion through repeated requests.

Vulnerability in Spring Data Commons allows denial of service through resource exhaustion when attacker-controlled property path strings are passed to MappingContext property path resolution.