CVE Vulnerability Catalog

The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution.

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts.

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, and macOS Tahoe 26.4. Processing a maliciously crafted file may lead to unexpected app termination.

Improper input validation and Exposure of sensitive information through data queries vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, and Genians Genian ZTNA V6.0 allows SQL Injection and Authentication Bypass. This issue affects specific versions before the indicated revisions.

OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (SSRF).

SPIP before version 4.4.20 contains a vulnerability allowing unauthenticated remote attackers to execute arbitrary code. The issue is related to incorrect identification of <?php blocks and var_export's mishandling of certain cases such as the presence of a '<' character. This vulnerability was exploited in the wild in August 2026.

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files.

A Server-Side Request Forgery (SSRF) vulnerability in PTC Windchill PDMLink and PTC FlexPLM may be exploited through deserialization of untrusted data.

A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.

A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability (WRR) Enterprise Edition.

A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499.

Tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities.

An SSRF vulnerability in the POST /api/provider-nodes/validate route in 9router allows an attacker to make server-side requests to internal addresses, including loopback and link-local, due to flaws in the assertPublicUrl guard. Additionally, internal responses may be disclosed, and the API key is forwarded to internal destinations.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

A vulnerability in SitemapLoader.parse_sitemap in langchain_community/document_loaders/sitemap.py allows an attacker who controls a sitemap to point a nested sitemap entry at an internal address, even when restrict_to_same_domain is set to True. The server will fetch internal content and disclose it in returned documents.

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored URL directly. The validatePublicHttpUrl helper in packages/backend/src/utils/ssrfProtection.ts, used for MCP server URLs, is not applied on either path, and the webhook fields carry no server-side URL constraint. A user able to create or trigger a scheduled delivery can therefore direct the server to issue POST requests to private, loopback and link-local addresses, including cloud metadata endpoints, and can distinguish reachable internal services from unreachable ones through the resulting errors. The upstream response is never returned to the requester; on a failure status its body is written to the server log instead. Version 1.146.4 routes both clients through postSchedulerWebhook from packages/backend/src/utils/schedulerWebhookValidation rather than calling fetch directly.

In EverShop, the customer update route is declared as public, causing the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route. An unauthenticated request with a known customer uuid can overwrite the customer's email and password, taking over the account. Version 2.2.1 changes the route to private.

The URLS regular expression in nltk/tokenize/casual.py, used by TweetTokenizer, contains an unbounded domain branch causing catastrophic backtracking on malicious input. A few kilobytes of text can consume seconds to minutes of CPU, enabling unauthenticated DoS. Version 3.10.1 bounds the label repetition.