CVE Vulnerability Catalog

In HAPI FHIR before version 6.9.4, ManagedWebAccessUtils.getServer() uses String.startsWith() to match request URLs against configured server URLs for credential dispatch. Without a trailing slash or host boundary check, an attacker-controlled domain like http://tx.fhir.org.attacker.com matches the prefix and receives Bearer tokens, Basic auth credentials, or API keys when the HTTP client follows a redirect.

NVIDIA BioNeMo contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, denial of service, information disclosure, and data tampering.

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

NVIDIA Jetson Linux has a vulnerability in initrd where an unprivileged attacker with physical access can inject incorrect command line arguments. Successful exploitation may lead to code execution, privilege escalation, DoS, data tampering, and information disclosure.

NVIDIA Jetson for JetPack contains a vulnerability in system initialization logic, where an unprivileged attacker can cause initialization of a resource with an insecure default.

The Tenda CH22 router version 1.0.0.1 has a stack-based buffer overflow vulnerability in the formWebTypeLibrary function in /goform/webtypelibrary. Manipulating the webSiteId argument allows remote code execution. The exploit has been publicly disclosed.

The PAGI::Middleware::Session::Store::Cookie module for Perl generates random bytes insecurely. If reading from /dev/urandom fails, it falls back to the rand function, which is not cryptographically secure. This can lead to a predictable initialization vector (IV) for encrypting session cookies.

Parse Server before versions 8.6.68 and 9.7.0-alpha.12 has a DoS vulnerability via GraphQL. By sending a crafted query with binary fan-out fragment spreads, an unauthenticated attacker can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments with requestComplexity.graphQLDepth or requestComplexity.graphQLFields enabled.

The JOSE library before version 0.3.5+1 allows an unauthenticated remote attacker to forge JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The library incorrectly treats header-provided keys as verification candidates even when not in the trusted key store.

Sliver before version 1.7.4 has a vulnerability where a single click on a malicious link gives an unauthenticated attacker immediate control over all active C2 sessions and beacons via the operator's browser, enabling data exfiltration or infrastructure destruction.

An arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

The Anthropic Claude installer for Windows (Claude Setup.exe) prior to version 1.1.3363 is vulnerable to DLL hijacking due to uncontrolled search path, allowing local privilege escalation.

OpenClaw before 2026.3.28 has an SSRF vulnerability in the fal provider image-generation-provider.ts component. Attackers can exploit unguarded image downloads to expose internal service metadata and responses through the image pipeline.

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

ZEBRA (Zcash node) prior to zebrad 4.3.0 and zebra-consensus 5.0.1 has a logic error in the transaction verification cache. A malicious miner can induce a consensus split by matching a valid transaction's txid with invalid authorization data, causing vulnerable nodes to accept an invalid block.

Parse Server prior to versions 8.6.66 and 9.7.0-alpha.10 does not respect the allowOrigin server option in the GraphQL API, unconditionally allowing cross-origin requests from any website. The REST API correctly enforces this restriction.

In Trino from version 439 to before 480, the Iceberg connector REST catalog exposes static credentials (access key) or vended credentials (temporary access key) to users with SQL write privilege.

mppx before version 0.4.11 did not check Stripe's Idempotent-Replayed response header when creating PaymentIntents. An attacker could replay a valid credential with the same spt token against a new challenge, and the server would accept the replayed PaymentIntent as a new payment without actually charging the customer. This allowed paying once and consuming unlimited resources.

mppx prior to version 0.4.11 contains a vulnerability in the tempo/session cooperative close handler. The close voucher amount validation uses "<" instead of "<=" against the on-chain settled amount. An attacker can submit a close voucher exactly equal to the settled amount, which is accepted without committing new funds, effectively closing the channel for free.

ZEBRA, a Zcash node written in Rust, prior to zebrad version 4.3.0 and zebra-chain version 6.0.1 contains a vulnerability in transaction processing logic. A remote, unauthenticated attacker can send a specially crafted V5 transaction that passes initial deserialization but fails during transaction ID calculation, causing the node to panic (crash).