CVE Vulnerability Catalog

The Seattle FilmWorks plugin in GIMP has a vulnerability involving unbounded stack allocation of a variable-length array when processing a specially crafted SFW file. This leads to an application crash and denial of service.

GitLab CE/EE versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user to cause a denial of service affecting background job processing due to missing object count limits.

Rently Smart Home versions 20.1.0 and prior have an Insufficiently Protected Credentials vulnerability. An attacker can retrieve pins including the Master Pin, overriding standard user permissions.

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk before 3.5.5.

RustDesk before version 1.4.7 has an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length in the frame header and reserves memory before receiving data, allowing memory exhaustion via multiple TCP connections.

RustDesk versions 1.3.9 through 1.4.9 contain a path traversal vulnerability in the macOS clipboard file-paste code path. A remote peer can write files outside the intended target directory using parent-directory components or absolute paths.

GitLab EE versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with project Maintainer permissions to access the terminal of a protected environment they were not authorized to use due to improper authorization checks.

Liderahenk from version 3.4.0 before 3.5.5 has an LDAP Injection vulnerability. Improper neutralization of special elements in an LDAP query allows manipulation of queries.

GitLab EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 have a vulnerability that allows an authenticated user with developer role to execute arbitrary commands in a CI context. This occurs through the Claude agent processing configuration from a user-controlled source.

The Formidable Charts plugin for WordPress up to version 2.0.1 has a Directory Traversal vulnerability via the 'frm_graph' parameter. An unauthenticated attacker can read the contents of arbitrary files on the server if certain conditions are met.

GitLab EE versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with developer-role permissions to influence the execution environment of Pipeline Execution Policy enforcement jobs due to improper handling of job dependencies.

An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in the tenant project using crafted JDBC connection string parameters. This vulnerability was patched on 1 May 2026, and no customer action is needed.

GitLab EE contains a DoS vulnerability in the SCIM user provisioning feature. An authenticated user can send specially crafted input causing an unbounded loop, leading to denial of service.

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within an unprivileged user namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (e.g., create, import, destroy), pool event log access (zpool events), and fault injection (zinject). Exploitation requires only that the local user can open /dev/zfs and that the kernel permits unprivileged user namespace creation.

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. The bus_load() function reads the number of bus handles from the "bus_handles" attribute without validating an upper bound, and bus_handle_moved() allocates stack arrays based on this count. Excessive values (e.g., 262144) cause stack overflow, SIGSEGV, and potential stack frame corruption.

The vulnerability allows unauthorized generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge_number' parameter as the HMAC private key, which remains static and is accessible via the API using the endpoint '/club/_id_club_/member/_id_member_/resamania_qr_info'. An attacker with access to this value and to the application's cryptographic logic, which can be extracted by reverse engineering the APK as there is no code obfuscation, could generate valid QR codes indefinitely, even after the user has changed their password or logged out.

Apache APISIX has a vulnerability relying on untrusted inputs in a security decision. An attacker can escalate privileges or bypass authorization by sending certain values not properly sanitized by the attach-consumer-label plugin.

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.

NLTK before 3.10.3 has a ReDoS vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regex patterns and executes them without validation, potentially causing catastrophic backtracking and blocking the Python process.

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.