CVE Vulnerability Catalog

Podatność CVE-2026-42602 dotyczy rozszerzenia Azure Authenticator, które w wersjach od 0.124.0 do 0.150.0 ma lukę w autoryzacji po stronie serwera. Umożliwia to każdej osobie posiadającej ważny token dostępu Azure autoryzację do dowolnego odbiornika OpenTelemetry, który używa autoryzacji 'azure_auth'.

Python-Multipart before version 0.0.27 did not limit the number or size of multipart/form-data part headers. An attacker can send a request with many repeated headers or a single very large header, causing excessive CPU load and denial of service.

The twisted.names module in Twisted, prior to version 26.4.0rc2, is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. An attacker can exploit this vulnerability by sending a crafted TCP DNS packet containing deeply chained compression pointers.

In CubeCart prior to version 6.6.0, authenticated time-based blind SQL injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database.

The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. The lack of security updates for this version may expose the application to publicly known security weaknesses.

Lokalnie serwisowana strona internetowa na urządzeniach Garmin WDU (w wersjach 1.4.6 i 2.5.0) pozwala na ominięcie mechanizmów uwierzytelniania. Strona WDU wykonuje uwierzytelnienie tylko w przeglądarce klienta, a WebSockety używane do komunikacji z serwerem WDU nie egzekwują żadnego uwierzytelnienia.

Lokalnie serwisowana strona internetowa na urządzeniach Garmin WDU (w wersjach 1.4.6 i 2.5.0) jest podatna na atak symlink. Umożliwia to atakującemu przesłanie złośliwego pakietu graficznego zawierającego symlinki, które serwer WWW śledzi podczas serwowania treści.

The Flight framework for PHP prior to version 3.18.1 has a vulnerability where the default error handler Engine::_error() exposes full exception details in the HTTP 500 response, including absolute filesystem paths.

The Flight framework for PHP prior to version 3.18.1 has a vulnerability that allows unconditionally honoring the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter for any HTTP verbs, including safe ones like GET. This can lead to CSRF escalation and bypassing security measures based on unsafe verbs.

In versions prior to 3.18.1 of the Flight framework, the SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() methods build SQL queries by directly concatenating the $table argument and the keys of the $data array, without proper identifier quoting and validation. This allows attackers to inject arbitrary SQL by crafting malicious array keys.

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier.

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to escalate privilege.

The vulnerability affects the Auth Proxy feature, which defaults to using /32 IPv6 addresses. Addresses specifying a mask explicitly are not affected by this vulnerability.

In cowboy (ninenines) from 2.0.0 before 2.15.0, `cowboy_req:read_part/3` accumulates request bytes into a buffer without an upper-bound check when multipart header parsing returns `more`. An unauthenticated attacker can send a multipart/form-data request that never yields a complete header section, causing linear memory growth and exhausting BEAM memory.

CVE-2026-43970 is a vulnerability related to improper handling of highly compressed data in the cowlib library, which can lead to remote denial of service attacks via memory exhaustion. It allows unauthenticated users to send specially crafted SPDY frames that can cause significant memory consumption.

A vulnerability in Netty (prior to 4.2.13.Final and 4.1.133.Final) in HttpContentDecompressor. The maxAllocation parameter limiting decompression buffer size is correctly enforced for gzip and deflate encodings but silently ignored for br (Brotli), zstd, and snappy. An attacker can bypass the decompression limit by sending a compressed payload with Content-Encoding: br instead of gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections.

A vulnerability in Netty's HttpClientCodec component causes incorrect pairing of HTTP responses with requests when using pipelining with GET and HEAD requests. When the server returns 103 and 200 responses, the queue pairs the HEAD response with the first 200 response, leading to incorrect data reading and stream offset.

Netty prior to versions 4.2.13.Final and 4.1.133.Final has a vulnerability in Lz4FrameDecoder that allocates a ByteBuf of size decompressedLength, potentially leading to uncontrolled memory allocation. An attacker can exploit a 21-byte header and compressed data to force this allocation.

In Netty before version 4.2.13.Final, the QpackDecoder's decodeHuffmanEncodedLiteral method allocates a byte array based on a length value from the wire without checking if enough readable bytes exist. An attacker can exploit this by sending crafted HTTP/3 header blocks, causing excessive memory allocation and denial of service.

Netty, an asynchronous event-driven network application framework, has a vulnerability in its DNS codec that does not enforce RFC 1035 domain name constraints during encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder.