CVE Vulnerability Catalog

sm-crypto before 0.5.0 in the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance from [email protected], which seeds an ARC4 stream from Math.random() and new Date().getTime() because window.crypto.getRandomValues is unavailable even though globalThis.crypto exists. An attacker who can observe the process's Math.random() outputs and estimate the key-generation time can reconstruct the seed, recover generated SM2 private keys, and predict signing ephemeral scalars used to forge signatures. This issue is fixed in version 0.5.0.

node-tar prior to version 7.5.21 has a vulnerability in the filesFilter function in src/list.ts, which uses the recursive mapHas helper to walk an archive entry path without a segment cap. A crafted GNU L or PAX x long-path header with thousands of segments can cause an uncatchable RangeError stack overflow, terminating asynchronous and streaming Node.js consumers. The issue is fixed in version 7.5.21.

@hono/node-server from version 2.0.0 to 2.0.10 has a vulnerability in WebSocket handling where an upgrade request with a missing or malformed Sec-WebSocket-Key header causes the request to remain in waiterMap with no cleanup path after the handshake is aborted. This allows an unauthenticated attacker to flood a public route, causing unbounded memory growth and service unavailability.

frp versions 0.53.0 through 0.70.1 have a vulnerability in the optional SSH Tunnel Gateway in pkg/ssh/server.go, where parsing an SSH exec channel request adds 4 to an attacker-controlled length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeating the bounds check and causing a panic in TunnelServer.handleNewChannel. When no authorized-keys file is configured, an unauthenticated peer can reach this phase before the frp token is checked, and a single five-byte request terminates the frps process and drops every active tunnel. The issue is fixed in version 0.70.1.

Backstage before version 0.29.2 has a vulnerability in the experimental dynamic client registration and client ID metadata document features in @backstage/plugin-auth-backend. Full-string glob matching can be bypassed, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. These features are experimental and disabled by default.

Mongoose before versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2 has a prototype pollution vulnerability when passing a user-controlled update with a __proto__.x dotted path under $set. The casting process can set properties on Object.prototype, affecting application integrity and availability.

Hub prior to version 0.2.16 has a vulnerability where every incoming unauthenticated WebSocket connection triggers loadDefaultConnectionEventListeners, which calls requestClientId and sends a get-client-id action, pushing a request into RPC.requests. The RPC.waitForReply function starts a setInterval polling loop every 10 milliseconds that is cleared only after a matching reply; if the client remains silent and closes, the timer and pending request stay allocated. Repeated connections cause unbounded timers and heap entries, exhausting CPU and memory and making the server unavailable. The issue is fixed in version 0.2.16.

Rainbond through version 6.9.7 contains a broken access control vulnerability in the CheckToken function that allows authenticated attackers to access unauthorized enterprise resources by substituting another enterprise's tenant name in URL paths. Attackers can use any valid API token to bypass enterprise ID verification and access or modify another enterprise's services, plugins, environment variables, and certificates.

CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service without any valid credentials and receive a root shell.

CyberPanel before version 3.0.0 has a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can access credential files, SSL/SSH private keys, and JWT secret files.

The 'podman quadlet install --replace' command opens the existing Quadlet file without O_TRUNC, which on filesystems without reflink support (e.g., default XFS on RHEL) leads to incomplete overwriting. If the new Quadlet is shorter than the original, old data remains at the end of the file, and the command completes without warning.

A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.

This CVE candidate has been rejected. Reason: This candidate was issued in error. All references and descriptions have been removed to prevent accidental usage.

A vulnerability in the parse_read_std_char_desc() function in the Bluetooth host subsystem (subsys/bluetooth/host/gatt.c) allows a remote, unauthenticated device to hang the Bluetooth processing thread by sending an ATT response with a zero entry length (rsp->len = 0). The parsing loop does not validate the minimum value of rsp->len, leading to an infinite loop (CWE-835) and failure to terminate descriptor discovery.

Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attackers can inject UNION-based SQL payloads through the unsanitized codeitemid parameter into the underlying Microsoft SQL Server query to retrieve sensitive database contents including user credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30 (UTC).

ASP-CMS contains a SQL injection vulnerability in the commentList.asp endpoint that allows unauthenticated remote attackers to inject arbitrary SQL by manipulating the id parameter in GET requests to the comment listing script. Attackers can bypass the application's keyword blocklist by interleaving the string 'master' within blocked SQL terms to extract sensitive database contents. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18 (UTC).

A flaw was found in the clusterclaims-controller component of Multicluster Engine (MCE). An authenticated tenant can exploit this vulnerability by manipulating ClusterClaim labels, forcing a cluster to join a ManagedClusterSet belonging to another tenant. Such unauthorized access could enable the injection of policies and workloads into other tenants' clusters.

SSRF vulnerability in migration asset downloads bypasses hostmatcher, allowing reading internal files and cloud metadata.

Unbounded Arch package file metadata can cause resource amplification in Gitea package uploads.

SQL injection vulnerability in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis before 2026.1.586 and before 2026.2.592.