CVE Vulnerability Catalog

In XWiki Platform prior to 17.10.5 and 18.2.0, the /skin/ action in SkinAction can resolve double-encoded parent-directory segments outside the intended resource prefix when Jetty 12 or later decodes the request path. An unauthenticated remote attacker can read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and potentially host files. The issue is fixed in versions 17.10.5 and 18.2.0.

In the GNU C Library versions 2.1 to 2.44, calling tdelete on a sufficiently deep tree may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree; two rebalancing branches push an additional entry without checking the capacity.

In GNU C Library versions 2.38 to 2.44, calling strfmon or strfmon_l can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls these functions with right-justified width padding into a destination buffer large enough for the padding but too small for the internal memmove call. At the time of publication, no network-facing application impact is known.

In GNU Binutils 2.47, a vulnerability was detected in the function _bfd_elf_write_section_eh_frame in the file bfd/elf-eh-frame.c, in the Eh Frame Section Handler component. Manipulation of the arguments cie_length/fde_length/augmentation_data_size/write_offset leads to a buffer overflow. The attack requires local access.

In GNU Binutils 2.47, a vulnerability was detected in the function elf_x86_64_relocate_section in the file bfd/elf64-x86-64.c, in the ld component. Manipulation of the argument roff leads to a buffer overflow. The attack requires local access. A fix is available in version 2.48.

In GNU Binutils 2.47, a weakness was identified in the function bfd_putl64 in the file bfd/libbfd.c, in the ld component. This manipulation causes a null pointer dereference. The attack requires local access.

In GNU Binutils 2.47, a security flaw was discovered in the function cache_bwrite in the file bfd/cache.c, in the ld component. Manipulation of the argument nbytes results in a buffer overflow. The attack requires local access.

A SQL injection vulnerability was identified in itsourcecode Leave Management System 1.0 in an unknown function of the file /module/company/index.php. Manipulation of the ID argument allows remote attack. The exploit is publicly available and might be used.

gRPC-Go prior to 1.82.2 and 1.83.2 allows servers created with xds.NewGRPCServer() to accept an RPC lacking both the :authority and Host headers. RouteAndProcess assumes an authority value exists and indexes an empty slice, causing an index-out-of-bounds panic that terminates the entire server process.

The vulnerabilities tracked by CVE-2026-76443 relate to improper neutralization issues grouped under CWE Pillar CWE-707 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.

Cisco Secure Email Gateway and Cisco Secure Email and Web Manager contain vulnerabilities found during an internal security review, related to improper validation of specified quantity in input (CWE-1284).

The vulnerabilities tracked by CVE-2026-76441 relate to improper access control issues grouped under CWE Pillar CWE-284 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.

The vulnerabilities tracked by CVE-2026-76440 relate to path traversal issues grouped under CWE Pillar CWE-23 and were found during Cisco's internal security review. They affect Cisco Secure Email Gateway and Cisco Secure Email and Web Manager.

Laravel MagicLink versions 2.0.0 through 2.25.1 store serialized action objects in the magic_links.action database column and deserialize them without sufficient integrity protection, with an unsafe legacy unserialize() fallback. An attacker able to manipulate database records can insert a malicious serialized object graph and execute arbitrary code when the magic link is visited.

Argos JavaScript SDK before core package version 6.2.1 allows attacker-controlled CI branch or ref values to be interpolated into commands executed by /bin/sh -c. Shell metacharacters in a pull-request branch name can execute arbitrary commands with Argos upload process privileges.

Alchemy CMS before versions 7.4.15, 8.0.15, 8.1.14, and 8.2.6 exposes an unauthenticated GET /api/pages/nested endpoint that returns an unfiltered page tree without authorization. Restricted and unpublished page metadata and element/ingredient content can be retrieved.

In webtransport-go prior to 0.11.1, Session.parseNextCapsule() in session.go skips an unknown WebTransport capsule on the HTTP/3 request stream by calling io.ReadAll on the capsule reader, retaining the complete declared capsule body in memory. A malicious peer can send a large unknown capsule and cause a client or server to allocate memory for the full payload, as QUIC flow control does not bound the total retained allocation. This results in memory and resource exhaustion that can disrupt or crash the affected process.

In dbt-mcp prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt Platform OAuth flow. The endpoint returns the full DbtPlatformContext, including access_token and refresh_token values, to any process that can reach 127.0.0.1:6785. The absence of TrustedHostMiddleware allows a remote attacker to use DNS rebinding against a victim's browser, while a co-located process can request the endpoint directly. The stolen tokens provide immediate dbt Platform API access as the victim and persistent access through the refresh token, allowing access to or modification of projects, jobs, environment secrets, and related account data.

gettext-converter before version 1.3.3 in js2i18next() uses dynamic object keys without rejecting __proto__, constructor, or prototype. Converting untrusted translation data can lead to prototype pollution affecting the entire process.