CVE Vulnerability Catalog

cryptography, a cryptographic library for Python, versions 44.0.0 through 50.0.0, is vulnerable to a Bleichenbacher-style attack. Functions pkcs7_decrypt_der, pkcs7_decrypt_pem, and pkcs7_decrypt_smime reveal differences in decrypting encryptedKey, which can be exploited to decrypt the content-encryption key. Exploitation requires a service auto-decrypting untrusted EnvelopedData, e.g., S/MIME gateways. Fixed in version 50.0.0.

The Svc::FileDownlink::SendPartial component in fprime framework v4.2.2 has an integer overflow vulnerability that allows an attacker to cause a Denial of Service (DoS) via crafted input.

Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove subscription commands.

A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via sending a crafted packet.

An issue in the CFDP receive path of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via replaying final CFDP PDUs.

Incorrect access control in the DS_SetDestPathCmd() component of NASA cFS v7.0.1 allows attackers to access sensitive components via a path traversal.

An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry.

Misskey, an open-source federated social media platform, versions 12.37.0 through 2026.5.4, is vulnerable to timing attacks during JSON-LD signature validation and compaction. Lack of shared JSON-LD parsing context between signature verification and processing leads to a TOCTOU flaw, allowing an attacker to have fraudulent activities accepted as valid. Fixed in version 2026.5.4.

The hawkBit device management client in Zephyr RTOS has a heap-based out-of-bounds write vulnerability. The response buffer lacks space for a terminating null byte, causing a single null byte write past the allocated memory when the response length matches the buffer size.

Guzzle, an extensible PHP HTTP client, prior to versions 7.15.2 and 8.0.1, has a vulnerability due to discrepancy between Guzzle's URI parsing and libcurl's. An attacker influencing the request URI can bypass application checks and access hosts that should be blocked. Fixed in versions 7.15.2 and 8.0.1.

AIOHTTP, an asynchronous HTTP client/server framework for Python, prior to version 3.14.3, has an out-of-bounds heap read vulnerability in the C response parser. While building an error message for a malformed response, an out-of-bounds read can occur, leading to DoS in the client. Fixed in version 3.14.3.

The Ref::SignalGen component of fprime framework v4.2.2 does not validate the safety of user-controlled parameters, allowing attackers to cause a Denial of Service (DoS) via inputting unsafe parameters.

An issue in the CF_CFDP_RecvMd() component of NASA cFS v7.0.1 allows attackers to control where received content and data is stored, possibly leading to an information disclosure.

Ouroboros, a runtime for AI coding agents, prior to version 0.42.1, has an incomplete denylist. Despite a previous fix (CVE-2026-47211), some keys enabling remote code execution (RCE) were not blocked. A malicious repository can use a .env file to bypass security and execute arbitrary commands. Fixed in version 0.42.1.

A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature.

Chisel is a TCP/UDP tunnel over HTTP secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake, but not on subsequent SSH channels carrying actual traffic.

FirmaCheck for Windows before 1.3.16 contains a DLL hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration file referencing an attacker-controlled DLL to achieve code execution at startup process privilege level when FirmaCheck.exe runs automatically at system startup.

A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate.

A security vulnerability in jina-ai reader up to commit 1574bfd380d249c86c82db4dace0d9c8fe17e2b1 affects the function isValidTLD in /backend/functions/src/cloud-functions/crawler.ts of the Crawler/Puppeteer component. The manipulation leads to server-side request forgery (SSRF). Remote exploitation is possible and the exploit has been publicly disclosed.

ip-address is a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. Prior to 10.3.1, Address4 accepts an octet with a leading zero and decodes it as decimal, while the WHATWG URL host parser, inet_aton, and getaddrinfo decode a leading zero as octal. This causes a disagreement between the library and the network stack about which host a string names. For example, new Address4('012.0.0.1') reports correctForm() as 12.0.0.1 and isPrivate() as false, but fetch('http://012.0.0.1/') connects to 10.0.0.1.