CVE Vulnerability Catalog

libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in git_delta_apply that trusts the attacker-controlled res_sz value, potentially leading to excessive memory allocations and memory exhaustion. Malicious pack data can be supplied via git_clone, git_fetch, git_remote_fetch, git_indexer_append, or a local repository.

libgit2 before versions 1.8.6 and 1.9.5 does not reject traversal components in a submodule path loaded from .gitmodules. A crafted repository can specify a path such as ../escape-target, and applications that initialize the submodule can create directories outside the repository working tree.

libgit2 before versions 1.8.6 and 1.9.5 has a vulnerability in verify_server_cert that uses an inverted !!memcmp result in the GEN_IPADD branch when comparing an IP-literal host with a certificate IP SubjectAltName. This causes rejection of matching IP addresses and acceptance of mismatched ones, allowing an attacker with a CA-trusted certificate to intercept connections to IP-literal HTTPS URLs.

Frappe version 16.31.0 and earlier has a vulnerability in the whitelisted toggle_like and mark_as_seen endpoints that do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata.

Shaarli before version 0.16.3 is vulnerable to stored XSS in BookmarkListController.php. The permalink handler concatenates the raw bookmark title into the page title and emits it into the <title> element without HTML escaping. A bookmark title containing </title><script>...</script> can execute a script in the Shaarli origin for any visitor. An attacker can convince an administrator to bookmark a malicious URL, leading to administrator account takeover.

SecureDrop Client before 1.3.1 can be tricked by a malicious SecureDrop Server responding with cross-origin redirects, bypassing securedrop-proxy's origin limitation.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

An unauthenticated remote attacker can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0.

In the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways, authentication credentials are transmitted over an unencrypted channel during communication with a third-party DDNS service. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.

A pre-authentication OS command injection vulnerability in Omada gateways configured as OpenVPN Server allows a remote attacker to inject commands via specially crafted input during OpenVPN connection establishment. Exploitation requires the OpenVPN Server feature to be enabled and the VPN service reachable.

Catalyst::Plugin::Static::Simple versions through 0.38 for Perl mark responses as publicly cacheable. The _serve_static method always sets the Cache-Control header to "public" with no means of overriding it, causing proxies to store content in a shared cache and reuse it in responses to other users' requests, including those with an Authorization header. Setting the expires time to "0" to disable caching is ignored.

A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in Tenda CH22 1.0.0.1 in the function formcreateFileName of the file /goform/formcreateFileName. Manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can send a crafted percent-encoded request path to a deployment using MG_ENABLE_DIRLIST and persuade a user to visit it. The mg_http_serve_dir() and listdir() path in src/http.c places the decoded request URI into the title and h1 elements without HTML entity encoding. The resulting reflected cross-site scripting executes in the Mongoose origin and can expose session data or perform actions as the victim. This issue is fixed in version 7.22.

Mongoose is an embedded web server and network library. Prior to 7.22, a remote attacker can place a lone carriage return or line feed in multipart input processed by mg_http_next_multipart() in src/http.c. The loops comparing s[b] and s[b + 1], and s[h2] and s[h2 + 1], use an incorrect AND condition and stop when either character resembles part of a CRLF terminator. This truncates headers, filenames, or boundaries and can cause an application to accept dangerous content after seeing a misleading Content-Type value. This issue is fixed in version 7.22.