CVE Vulnerability Catalog

Tina (headless CMS) versions prior to 3.0.0 — @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD and interpolates the raw value into the API URL and JavaScript string literals in generated code. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The issue is fixed in version 3.0.0.

Jexactyl versions prior to 4.0.5 — the POST /api/client/billing/stripe/process endpoint accepts a client-supplied Stripe Checkout Session when payment_status is paid but does not compare amount_total or currency with the referenced order and configured billing currency. An authenticated client can complete a lower-value or mismatched-currency payment and cause the order to be processed. The issue is fixed in version 4.0.5.

OpENer v2.3/commit 76b95cf contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

OpENer v2.3/commit 76b95cf contains an integer underflow in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

OpENer v2.3 (commit 76b95cf) contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service.

yopass before version 14.7.0 uses the attacker-controlled r.Method value directly as the method label for Prometheus metrics. An unauthenticated remote attacker can submit many unique methods and create metric series that are never evicted, leading to unbounded memory growth and potential OOM-kill.

ageLANServer before version 1.15.2 has no request body size limit or cap on the attacker-controlled JSON names array in the POST /game/cloud/getFileURL handler. A remote unauthenticated client can send an oversized request causing excessive memory allocation, crashes or hangs the server.

RIOT from version 2023.07 through 2026.07 ignores a failure returned by _resp_init() in nanocoap_fileserver when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a large extended token, causing response initialization to fail and leading to an assertion that terminates the service or task.

RIOT in 2026.07 and earlier, the _receive() function in gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. A remote attacker can send a malformed 6LoWPAN fragment causing read beyond the packet buffer, potentially disclosing memory and crashing the network stack.

RIOT in 2026.07 and earlier, the nanocoap_sock_get_slice() function accepts a Block2 response when _block_cb() sees the expected block number without verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing offset underflow and read before the payload buffer, potentially crashing the client.

OWASP Coraza WAF from 3.0.0 until 3.8.1, readJSON in json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with a fatal stack overflow.

MariaDB from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, potentially escalating database privileges.

MariaDB from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code.

MariaDB from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service.

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.

Argo CD repo-server is vulnerable to command injection when it clones, tests, or fetches an SSH Git repository configured with a proxy URL. The proxy host and port are embedded in an SSH ProxyCommand executed through a shell without neutralizing shell metacharacters. A user who can create or update a repository or repository credential template can execute commands in the repo-server and access its Git, Helm, and OCI credentials.

AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.

AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat. Unsanitized LLM output rendered via v-html allows remote attackers to execute OS commands by embedding prompt-injection content that invokes the unrestricted open-path IPC handler with shell metacharacters.

Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability allowing remote unauthenticated attackers to take over accounts. Attackers register a victim's unverified email on an enabled OAuth/OIDC provider, exploiting the missing email_verified check in GenericOidcProvider, to sign in as the victim including administrators while bypassing TOTP.