CVE Vulnerability Catalog

In V through version 0.5.2, an SSRF bypass vulnerability exists that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. A crafted URL with a backslash in the authority section can bypass validation and connect to an internal host.

Netty prior to versions 4.1.136.Final and 4.2.16.Final is vulnerable to a forced WebSocket upgrade via the lax V07/V08 handshaker. An attacker can send Sec-WebSocket-Version: 7 while omitting Connection: Upgrade and Upgrade: websocket headers, completing a protocol switch unrecognized by proxies, enabling HTTP request smuggling and protocol-confusion attacks.

In consul-mcp-server versions 0.1.0 through 0.1.3, the Consul backend address was not restricted, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect Consul API traffic to an attacker-controlled endpoint and potentially exfiltrate the Consul token.

The TL-WR940N v6 router has a vulnerability in its RTSP connection tracking module that leads to a stack-based buffer overflow. When a LAN client connects to a malicious RTSP server, a crafted RTSP message can trigger improper memory handling in the kernel module.

In Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS, improper certificate validation in the Devolutions Server connection handling allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate.

In Netty prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in the compression codec pipeline is vulnerable to a denial-of-service attack via a malformed bzip2 stream that causes an infinite loop in the event-loop thread. The vulnerability exists in the RLE state machine within `Bzip2BlockDecompressor.read()`.

Netty prior to versions 4.1.136.Final and 4.2.16.Final has a resource exhaustion vulnerability in HttpContentEncoder (superclass of HttpContentCompressor). The acceptEncodingQueue accumulates attacker-controlled data without size limit, and using HTTP/1.1 pipelining can lead to memory or I/O resource exhaustion.

In the traceparser library, the decode() function has an improper input validation vulnerability. An attacker with a corrupted kernel trace event log (.kev) file can execute arbitrary code or cause a crash in processes that use libtraceparser on QNX hosts or targets.

In 7-Zip, a heap-based buffer overflow vulnerability exists in XZ decompression that allows remote code execution. User interaction is required – the victim must visit a malicious page or open a malicious file. Crafted XZ-compressed data can trigger a heap-based buffer overflow.

A SQL injection vulnerability in Coverity Connect SOAP API for versions 2024.6.0 through 2026.3.0. An authenticated attacker can send a crafted payload to achieve full read access to the database and execute unauthorized commands.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's POSIX CPU timers mechanism. The issue arises from a race condition during a non-leader exec() call, potentially leading to access of a freed timer object.

In the Linux kernel, the s390/pkey driver lacked a length check in the PKEY_VERIFYPROTK ioctl. The vulnerability allows user-space to supply a request structure exceeding the buffer size, potentially leading to a buffer overflow.

In the Linux kernel, the s390/pkey driver lacked a length check for the target buffer in the pkey_pckmo handler for key_to_protkey(). If the generated output exceeds the buffer length, the function fails, but without proper validation it could lead to a buffer overflow.

In proot-distro before version 5.1.6, the restore function accepted hardlink entries whose linkname referenced another installed container without verifying the source. This allows copying files between isolated containers via a crafted archive.

In ZITADEL from 2.43.0 through 2.71.19, 3.0.0 through 3.4.11, and 4.0.0 through 4.15.1, the email and phone self-management APIs allowed users to request returned verification codes without required permissions. This allows claiming ownership of other users' email addresses or phone numbers and bypassing email/phone-based security policies.

In proot-distro before version 5.1.5, installation functions extracting tar archives and Docker layers did not validate archive-controlled symlink targets. This allows planting a symlink to a host path and writing files to the host filesystem.

In Quay, a user configured in GLOBAL_READONLY_SUPER_USERS can view robot account tokens for repositories they are not a member of. This allows an attacker with read-only superuser privileges to impersonate any robot account.

In @fastify/rate-limit before version 11.2.0, rate-limit keys are based on the verbatim client IP. An IPv6 client can bypass the limit by rotating addresses or using different representations of the same address. This affects applications using this module to protect endpoints when trustProxy is enabled.

In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles malformed Cache-Control private directives. A response with a private directive set to an empty value can be stored in the shared cache and served to other users, disclosing private data. Additionally, combining an unqualified and qualified private directive causes a TypeError that can crash the process.

An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.