CVE Vulnerability Catalog

The Time Series Visual Builder (TSVB) plugin in OpenSearch Dashboards has an improper input validation vulnerability that allows an authenticated remote user to execute arbitrary code on the server via a crafted JSON payload to the metrics visualization API endpoint. This is a form of prototype pollution leading to remote code execution.

In lin-snow Ech0 up to 5.4.1, a vulnerability exists in the MD5Encrypt function in internal/util/crypto/crypto.go. The use of a risky cryptographic algorithm can be exploited remotely, though the attack complexity is rather high.

In the ClickHouse connector deployment template in Amazon Athena Federated Query prior to v2026.17.1, there is incorrect privilege assignment. An authenticated remote user can read arbitrary AWS Secrets Manager secrets in the deploying account by pointing the connector's connection string at an unrelated secret and at a database endpoint under the user's control, causing the connector to transmit the secret to that endpoint.

In the github-issue-bot templates in appwrite/templates, the GitHub webhook signature verification is inverted. When the X-Hub-Signature-256 header is absent, the verifyWebhook function returns success without HMAC verification, allowing unauthenticated requests to pass and post a comment on a chosen repository and issue using the configured GITHUB_TOKEN.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

An unauthenticated attacker with network access to the captive portal service can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

A vulnerability in Comfast CF-N1-S version 2.6.0.1 affects the function sub_44B50C in the file /cgi-bin/mbox-config?method=SET&section=ptest_channel. Manipulation results in a stack-based buffer overflow, and the attack can be launched remotely. The exploit has been made public and could be used.

django CMS from 5.0.8 until 5.0.9 has a vulnerability where ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values to ContentRenderer.render_exception when plugin rendering fails in edit mode. Values from get_short_description(), the exception message, the placeholder, or placeholder.source are interpolated into a cms-rendering-exception heading and later returned through mark_safe. Because the heading is not escaped, stored HTML executes in an editor’s browser, and settings.DEBUG does not prevent the custom heading from rendering.

BunkerWeb prior to 1.6.13 has a vulnerability in the blacklist, greylist, and antibot modules that trust PTR suffix matches in IGNORE_RDNS, GREYLIST_RDNS, and ANTIBOT_IGNORE_RDNS without using get_ips to confirm that the hostname resolves to the client address. An unauthenticated remote attacker who controls a PTR record can spoof a trusted suffix to bypass rDNS-based blacklisting, gain greylist treatment, or skip an antibot challenge.

msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer.

hank-ai/darknet has a vulnerability where convolutional layer weight and output heap buffers are sized using unchecked 32-bit integer arithmetic on configuration fields from a .cfg file. A crafted .cfg can cause undersized allocation, leading to heap buffer overflow during forward_convolutional_layer. Loading the crafted .cfg is sufficient, no valid .weights file is required.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

A vulnerability in Lighthouse allows a remote attacker, after compromising a spoke cluster, to inject unauthorized EndpointSlices and ServiceImports into any namespace on peer clusters, including critical system namespaces. This occurs because the destination namespace is derived from an attacker-controlled label or annotation on the broker object.

A flaw in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes stems from insufficient validation of advertised IP addresses in EndpointSlice objects. A compromised spoke cluster can create EndpointSlices with attacker-controlled IPs, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints, enabling Man-in-the-Middle attacks.

A vulnerability in Submariner allows a malicious cluster (spoke) to redirect network traffic from other connected clusters by publishing a specially crafted network endpoint. The system fails to properly validate network subnets, enabling the malicious cluster to declare arbitrary network ranges.

Frappe prior to 15.115.0 and 16.27.0 has a vulnerability in the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py that return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users.

Frappe before versions 15.114.0 and 16.26.0 has a vulnerability in the OAuth2 consent flow that allows an attacker to cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client. This is due to missing POST restriction, missing CSRF token, and lack of client scoping for active OAuth tokens.

A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0.