CVE Vulnerability Catalog

OpenBao prior to 2.5.5 allows a user with access to sys/leases/revoke/:lease_id in one namespace to revoke a lease in another namespace when the foreign lease_id is known. The lease lookup routing in vault/expiration.go lets FetchLeaseInfo and loadEntry resolve lease data outside the request namespace, enabling one tenant to revoke another tenant's lease and underlying credential.

OpenBao prior to 2.5.5 uses EscapeLDAPValue (an RFC 4514 DN escaping function) where RFC 4515 LDAP search-filter escaping is required in GetUserDN. With the LDAP authentication backend configured for Active Directory, an attacker-controlled username containing filter metacharacters can alter the search predicate and select a different directory entry, allowing a token to be associated with another identity and gain access to its secrets.

OpenTelemetry Collector Contrib prior to 0.151.0 has a vulnerability in githubreceiver where RequiredHeaders validation is only performed at startup, not on incoming webhook requests. An unauthenticated sender can bypass the authentication control and submit arbitrary webhook payloads, and when the Secret field is empty, HMAC validation is also skipped, allowing injection of fabricated CI/CD data into the observability pipeline.

Capsule from 0.13.0 to 0.13.6 has a vulnerability in the validating webhook configuration where namespace/finalize is used instead of the Kubernetes resource name namespaces/finalize. A user with namespaces/finalize RBAC can send a PUT request to /api/v1/namespaces/{namespace}/finalize, and the singular rule never matches the plural resource, so the validating webhook is not invoked and the user can change the namespace tenant label.

Kiwi TCMS is an open source test management system. Prior to 16.1, TestCase.extra_link and TestPlan.extra_link accepted unsanitized user input and rendered stored values verbatim, creating an opportunity for cross-site scripting. Official Docker images and unmodified Kiwi TCMS middleware send a Content-Security-Policy header that blocks inline JavaScript, making exploitation difficult in default deployments, while customized deployments that weaken those security settings may remain vulnerable. Version 16.1 properly sanitizes both fields and resets existing database records that do not validate to null. This issue is fixed in version 16.1.

Signal K Server prior to 2.28.0 has a vulnerability in makeRemoteRequest() that accepts attacker-controlled host, port, useTLS, and selfsignedcert parameters without validating the destination. When security is not configured, the endpoints testSignalKConnection, requestAccess, and checkAccessRequest are accessible without authentication, allowing port scanning, exfiltration of cloud metadata and internal service data, and lateral movement.

Surfio, a library for reading and writing surface files, does not correctly validate size fields in IRAP files prior to 0.0.19, leading to a buffer overflow when untrusted files are parsed. The issue is fixed in version 0.0.19.

In Kiwi TCMS prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1.

ToolHive prior to 0.29.1 has a flaw in networking.IsPrivateIP (pkg/networking/utilities.go) that omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed, enabling blind probing of internal TCP/TLS reachability on a host behind a NAT64/DNS64 gateway.

In ArcadeDB prior to 26.6.1, the IMPORT DATABASE statement did not require administrative privileges and passed its source to the importer without validation. An authenticated user with SQL command access via /api/v1/command or /api/v1/query can supply HTTP/HTTPS destinations to make server-side requests to internal services, or file:// paths to read files accessible to the server process and ingest them as records. The XML importer also permits DTD processing and external entities.

In ArcadeDB prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty, leaving the remaining public schema mutators in LocalDocumentType.java and LocalProperty.java unchecked. An authenticated identity, including a read-only API token without UPDATE_SCHEMA permission, can use DROP PROPERTY, ALTER TYPE, or ALTER PROPERTY through the HTTP endpoints to rename types, change inheritance, alter aliases or buckets, drop properties, and change property constraints.

GitHacker 1.1.7 and earlier: add_head_file_tasks parses an attacker-controlled ref path from .git/HEAD and joins unvalidated path segments onto temp_dst/.git/logs/, allowing a malicious server to make GitHacker read an arbitrary local file when a victim runs the tool against the server's URL. add_hashes_parsed then scans the file for 40-character hexadecimal substrings and requests each match through .git/objects, creating an attacker-observable existence oracle and disclosing matching hexadecimal fragments. Complete file contents are not returned, and the write path in 1.1.7 does not permit an escape. This issue is fixed in repository version 1.1.9.

In SingularityCE and SingularityPRO prior to 4.4.2 and 4.3.9/4.1.14 respectively, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to be run when /data/safe is allowed under setuid mode. This permits a user to run a container from outside the administrator's configured path allowlist. Installations that do not use limit container paths are not affected.

In Decidim prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The question_title helper returns the translatable question body through html_safe without a sanitization boundary, causing stored script execution when visitors open public election pages or voting booth screens. The persisted script executes in visitors' browsers.

fluent-plugin-opentelemetry prior to 0.5.3: the in_opentelemetry HTTP input read the entire incoming request body and decompressed payloads into memory without enforcing maximum size thresholds. When an OpenTelemetry ingestion endpoint was exposed to an untrusted network, an attacker could send an excessively large request or a highly compressed payload that expanded in memory. The resulting memory exhaustion could cause the operating system to terminate the Fluentd process, disrupting all log collection and forwarding on the affected node.

TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access. This allows obtaining full access to the device without knowing individual credentials.

Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Remote Code Execution (RCE) and tenant-project token theft.

Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed characters in request headers. Attackers can inject CRLF sequences into header values to inject arbitrary headers or construct entirely new HTTP requests.

Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunked body as a subsequent request. Attackers can exploit this inconsistency when Tornado is deployed behind proxies to perform HTTP request smuggling.

Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standard characters. Attackers can send crafted HTTP requests with these characters to bypass proxy validation and smuggle requests when deployed behind certain proxies.