CVE Vulnerability Catalog

Bifrost before version 1.5.17 incorrectly classifies addresses from CGNAT, 6to4, NAT64, and fec0::/10 ranges as public. An attacker controlling a multimodal request URL can make the gateway fetch internal services, including cloud instance metadata.

Pimcore before versions 11.5.19, 12.3.10, and 2026.1.6 has a vulnerability in Hotspotimage::getDataFromResource() that passes the __hotspots column to Pimcore\Tool\Serialize::unserialize() without an allowed-classes restriction after JSON decoding fails. An attacker with the ability to write crafted PHP serialized bytes into that column can instantiate available classes and trigger magic methods, potentially leading to arbitrary file writes or code execution. This issue is fixed for Hotspotimage in versions 11.5.19, 12.3.10, and 2026.1.6.

MariaDB Connector/Node.js before versions 3.3.3, 3.4.6, and 3.5.3, when SSL is enabled without a pinned CA or server certificate, sends credentials before completing certificate fingerprint validation. An active man-in-the-middle can capture the database password.

KubeVela before versions 1.9.14, 1.10.9, and 1.11.0-alpha.4 has a vulnerability in the Terraform remote configuration loader. A user with permission to create or update ComponentDefinition can point terraform.path to /dev/zero, causing an unbounded read and memory exhaustion.

free5GC in version 4.2.2 and earlier has a vulnerability in the NRF RegisterNFInstance handler that accepts NF Profiles without enforcing UUID format, nfStatus enum values, heartBeatTimer ranges, mandatory profile fields, or nfServices.ipEndPoints address constraints. Invalid profiles are persisted in MongoDB and returned by NFDiscover, allowing an attacker with SBI access to advertise attacker-controlled endpoints and redirect control-plane signaling. This issue is fixed in version 4.2.3.

Vikunja before version 2.4.0 allows mass assignment of the project_view_id value in POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}. The permission check validates that the bucket belongs to the URL project and view but does not validate the destination view in the body, allowing any authenticated user to relocate an attacker-owned bucket into another tenant's Kanban view.

Vikunja before version 2.4.0 has a vulnerability in the POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks endpoint. Authorization only checks the project, view, and bucket from the URL, but does not check task permissions, allowing an authenticated user to read and modify tasks from other tenants.

Vikunja from version 0.24.6 to 2.4.0 has a vulnerability in the DELETE /api/v1/projects/:project/views/:view endpoint. An authenticated user can supply a view identifier from another project while authorization only checks the project identifier, allowing deletion of Kanban assignments and task ordering in other tenants.

Vikunja from 2.3.0 until 2.4.0 allows a user with Write but not Admin permission on a shared child project to detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/projects/{project}. The authorization check bypasses the Admin requirement for zero values, allowing bypass of the fix for CVE-2026-35595.

dd-trace-rs is a Datadog library for application performance monitoring in Rust. From version 0.1.0 to 0.3.3, the parsing of the W3C tracestate header in tracecontext.rs collects all semicolon-separated key-value pairs from the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in version 0.3.3.

Vikunja from 0.21.0 until 2.4.0 allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project. The permission check in the duplication operation skips the write-permission requirement for the parent project, allowing injection of content into another user's or team's project hierarchy.

Klever-Go before version 1.7.19 has a vulnerability in decoding split-royalty fields that can contain values greater than core.HundredPercent, and summing in uint32 accumulators can wrap the validation sum to zero and bypass checks. Royalty payout paths credit each oversized split amount and silently discard a negative remainder, allowing ordinary transfers to create unbacked KLV or other assets. This issue is fixed in version 1.7.19.

Klever-Go before version 1.7.19 has a vulnerability in marketplace settlement where it reads MarketOrderData.ReferralPercentage from the listing while reading asset.Royalties.MarketPercentage live at purchase time. An asset owner can create a valid listing and then use AssetTrigger UpdateRoyalties to make the combined percentages exceed the bid. executeBuyMarket pays referral and royalty amounts unconditionally while computeMarketOwnerAmount silently skips a nonpositive seller remainder, allowing more currency to be credited than paid. This issue is fixed in version 1.7.19.

Hatchet from 0.40.0 until 0.91.1 does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context in Dispatcher/UpsertWorkerLabels and Dispatcher/Unsubscribe. An authenticated owner of any tenant who guesses another tenant's worker UUID can overwrite that worker's affinity labels or disconnect the worker from the dispatcher.

Kubeflow Pipelines before version 2.17.0 has an unauthenticated SSRF vulnerability in the /_proxy/ route in frontend/server/proxy-middleware.ts. The _routePathWithReferer() function accepts an arbitrary attacker-controlled HTTP or HTTPS target and passes its origin to createProxyMiddleware without a host allowlist or filtering for loopback, link-local, RFC1918, or cluster-local addresses. The route is accessible without authorization, allowing requests to be forwarded to internal services and responses returned to the attacker. This issue is fixed in version 2.17.0.

Incorrect access control in the getIpPortFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain IP and port filtering rules by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getUrlFilterRules function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getDmzCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain DMZ configuration information by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getSyslogCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain syslog-related configuration by sending a crafted POST request to /cgi-bin/cstecgi.cgi.

Incorrect access control in the getVpnPassCfg function of TOTOLINK T6 allows unauthenticated attackers to obtain VPN pass-through and WAN ping filter settings by sending a crafted POST request to /cgi-bin/cstecgi.cgi.