CVE Vulnerability Catalog

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This affects Node.js 26.x, 24.x, and 22.x.

A command injection vulnerability was identified in GL.iNet AX1800 up to 4.8.3 in the remove_rule function of /usr/share/gl-ngx/oui-rpc.lua (RPC Endpoint component). Manipulation of the args.id argument allows remote command execution. The exploit is publicly available.

The Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in handling authenticated HTTP request bodies, which may lead to a buffer overflow and crash of the web service process. Successful exploitation may cause the web service to stop responding or restart, resulting in a denial-of-service condition.

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster, allowing a file with attacker-chosen name and contents to be written or an outbound network request to be made. This can lead to remote code execution if the file is written to a location later imported by the application.

Missing permission check on the /api/v1/files route in Flowise before version 3.1.3, allowing low-privileged API keys to list and delete files across the organization.

Remote code execution vulnerability in LAMP Rapid Development Platform, where GlueFactory executes unsandboxed Groovy scripts from database template fields without compilation restrictions.

Memory corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.

Transient denial of service (DoS) when processing a short target wake time channel usage response frame with insufficient packet size.

Weak configuration in UE (User Equipment) where it does not verify the consistency of its additional security capabilities with replayed capabilities.

Memory corruption occurs while processing IOCTL device driver requests with invalid arguments.

Memory corruption occurs when handling malformed request parameters in the fingerprint TA.

Cryptographic vulnerability when processing registration requests with malformed or missing authentication parameters.

Memory corruption while processing a packet with a size close to the maximum allowed value.

Flowise before 3.1.3 has an unauthenticated OAuth2 token refresh endpoint that performs server-side HTTP requests to attacker-controlled URLs without SSRF protections, exposing responses and credentials.

The fix for CVE-2026-18401 in jackson-core is incomplete and leaves a bypass in the non-blocking parser. An attacker can stream JSON in small chunks without a terminator, causing unbounded buffer growth limited only by maxStringLength (20 MiB) instead of maxNumberLength (1000).

Perspective 5.0.0 contains a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths.

Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher allowing unauthenticated attackers to crash the server process by sending malformed or incomplete protobuf messages.

Perspective 5.0.0 contains a remote code execution vulnerability allowing unauthenticated attackers to execute arbitrary OS commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes input directly to Python's eval().

VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0 has a code injection vulnerability in the Python Validation Handler component in the /code file, allowing remote code execution.

Liman MYS from 2.2.3 before 2.3.1 has a missing authorization vulnerability allowing privilege escalation.