CVE Vulnerability Catalog

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

OliveTin before commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d has a vulnerability that allows arguments whose names start with 'ot_' to bypass the filterToDefinedArgumentsOnly filter. These arguments are not type-checked, are set as environment variables and passed to executed commands, and are also available in the template context.

WeeChat versions 0.3.1 through 4.9.0 use non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords in relay authentication. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate without knowing the password. Version 4.9.1 fixes the issue.

WeeChat versions 4.3.0 through 4.9.0 have a vulnerability in the WebSocket permessage-deflate decompression function relay_websocket_inflate() in the relay module, which has no upper bound on output size. An authenticated relay user can send a small compressed WebSocket frame (~100 bytes) that decompresses to gigabytes, exhausting all server memory and crashing the entire WeeChat process.

FORT Validator versions through 1.6.7 contain an origin-validation error in RRDP processing: a delegated CA under the same TAL can reference a victim CA's public RRDP notification and snapshot URLs, causing FORT's URL-based download cache to report success after deleting the victim's local snapshot. This can silently remove the victim's VRPs and other signed objects from FORT's output, potentially enabling route hijacking or loss of reachability. Version 1.6.8 contains a patch that rejects cross-origin RRDP snapshot and delta URLs.

Recce before version 1.50.0, in OSS server deployments exposed to an untrusted network without authentication, is vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and write files accessible to the Recce server process.

Arc Enterprise prior to version 26.06.1 validates only the wire-format envelope (length, opcode) of inbound messages in the cluster replication receiver. The MsgReplicateSync payload is accepted without any application-layer authentication (no HMAC, signature, or per-message nonce). Transport-layer TLS/mTLS does not protect against application-layer tampering or replay. Fixed in 2026.06.1.

Arc Enterprise prior to version 26.06.1 accepts attacker-chosen file paths in manifest-registration proposals in the Raft FSM without validating them against the configured storage backend. The only check is that the path is non-empty; there is no parent-traversal rejection, allowlist, scheme restriction, or length bound. Fixed in 2026.06.1.

Arc versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/* and add /debug/pprof to PublicPrefixes, making these endpoints reachable without authentication. Version 26.06.1 contains a patch. Workarounds include blocking /debug/pprof* at a reverse proxy or restricting the API port to trusted networks.

Arc prior to version 26.06.1 blocked only read_parquet( and arc_partition_agg( via regex denylist in the user-SQL validator. Other DuckDB I/O functions (read_csv, read_json, glob, etc.) were not blocked. RBAC table-reference extraction only inspected FROM/JOIN clauses, so scalar table functions in SELECT slipped past. Fixed in 26.06.1 via a structural sandbox at the DuckDB layer.

Combodo iTop is a web-based IT service management tool. Prior to version 3.2.3, an unauthenticated user could delete the .readonly file on iTop instances — a file created during the setup process that prevents users from performing write actions. This issue has been fixed in version 3.2.3.

Combodo iTop prior to 3.2.3 only protects classes present in the SELECT clause with the silos access check in OQL. This issue has been fixed in version 3.2.3.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.

RaTeX prior to version 0.1.11 panics on the 9-byte input \verbéxé because the parser slices the verbatim argument with byte indices, and index 1 lands inside a multibyte UTF-8 character. Since the release profile sets panic = "abort", the panic aborts the entire process, causing a hard denial of service. Version 0.1.11 fixes the issue.