CVE Vulnerability Catalog

PHP Object Injection vulnerability in OptionTree versions up to 2.7.3, requiring editor privileges. An attacker can inject serialized PHP objects, potentially leading to arbitrary code execution.

Denial of service vulnerability in Expat through 2.8.3. The storeAtts() function in xmlparse.c has quadratic complexity, causing excessive CPU consumption when processing an XML document with many attributes with non-normalized values.

Use-after-free vulnerability in Valkey prior to versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. The RESTORE command accepts a malformed RDB stream that assigns one NACK to multiple consumers, potentially allowing remote code execution.

A vulnerability in the ONNX library from version 1.3.0 to 1.22.0 allows an out-of-bounds read in Gemm_7_6::adapt_gemm_7_6() during opset 7 to 6 downgrade when a Gemm node has input tensors with fewer than two dimensions. This can cause a process crash.

Vulnerability in Dell Watchdog Timer Driver versions prior to 2.0.0.1. An exposed IOCTL with insufficient access control allows a low-privileged attacker to escalate privileges.

In yawkat LZ4 Java before version 1.11.1, JNI-backed XXHash functions fail to validate the byte array and off/len arguments, allowing null arrays or oversized ranges to reach native code. This can cause reads outside the Java array and fatal JVM termination. Fixed in version 1.11.1.

Seroval prior to 1.5.3 allows attacker-controlled JSON deserialization that can lead to unintended side effects, and when combined with frameworks registering callable wrappers, potentially unintended server-side invocation or remote code execution.

Vulnerability in Mastodon prior to versions 4.4.19 and 4.5.12. The ldap_authenticable.rb file mutates global OpenSSL parameters when LDAP uses LDAP_TLS_NO_VERIFY=true, disabling SSL/TLS certificate verification for puma web processes.

Valkey, a distributed key-value database, contains a use-after-free vulnerability in the tlsProcessPendingData function. An authenticated client can trigger CLIENT KILL, causing deletion of a node from the list and potentially leading to server crash or remote code execution when TLS is enabled. The issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1.

Oh My Zsh, a framework for managing Zsh configuration, has a vulnerability in the dotenv plugin. After changing to a directory containing a .env file, its contents are executed as shell commands with the current user's privileges, even without a prompt when ZSH_DOTENV_PROMPT=false or after default confirmation. The issue is fixed in versions released after 2026-05-28.

In goshs, a SimpleHTTPServer written in Go, before version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same snapshot and pass the check, exceeding the intended cap. Version 2.1.0 patches the issue.

goshs, a simple HTTP server written in Go, does not enforce mode-restriction flags (--read-only, --upload-only, --no-delete) on the WebDAV port when WebDAV is enabled (-w). An authenticated WebDAV client can perform PUT, DELETE, MKCOL, MOVE, and COPY operations despite the operator's intent. The issue is fixed in version 2.1.0.

SSH.NET, an SSH library for .NET, has a vulnerability in ScpClient.Download that trusts file and directory names returned by a remote SCP server. A malicious or compromised server can use ../ sequences or absolute paths to create or overwrite files anywhere writable by the client process. The issue is fixed in version 2026.0.0.

Trilium Notes, a hierarchical note-taking application, has an XSS vulnerability in the #iconClass value, which is inserted without HTML attribute encoding. A stored payload can execute automatically when a victim opens a new tab or uses Ctrl+J, and due to enabled nodeIntegration and disabled contextIsolation in Electron, it can run operating-system commands. The issue is fixed in version 0.103.0.

OttoKit versions up to 1.1.35 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send requests from the server to internal resources.

ThumbPress versions prior to 6.5 contain an unauthenticated Broken Access Control vulnerability. Unauthenticated users can perform operations they are not authorized to do.

BP Better Messages versions up to 2.15.22 contain an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject a malicious script that executes in the victim's browser.

Ezoic versions up to 2.22.11 contain an unauthenticated Broken Authentication vulnerability. An attacker can bypass authentication mechanisms and gain unauthorized access.

A user with the Contributor role can upload arbitrary files in Templatiq versions up to 0.2.5.

PDF Smart Viewer for Elementor versions up to 1.0.4 contain an unauthenticated Server Side Request Forgery (SSRF) vulnerability. An attacker can send requests from the server to internal resources.