CVE Vulnerability Catalog

In libsoup, when the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap buffer overflow.

In libsoup, when constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow.

In libsoup, when max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data.

In libsoup, the soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length could remain uninitialized and be used as the size of the returned GBytes. This can lead to an out-of-bounds read or application crash when processing a crafted data URI.

In Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0, the allowedLocalRoots path validation checks directories lexically without resolving symbolic links. A remote authenticated attacker with tool execution permissions can bypass directory boundary restrictions and access or overwrite arbitrary local files outside the permitted root directories.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have an MFA authentication bypass vulnerability due to premature issuance of a rememberme cookie. This allows bypassing the multi-factor authentication requirement.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have SSRF vectors in various core extensions. URLs used for serverside requests were improperly validated, leading to SSRF vectors.

Joomla! Core lacks escaping in the HTMLHelper::link method, leading to XSS vulnerabilities. Affects versions 1.5.0-5.4.8 and 6.0.0-6.1.3.

SQL Injection vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL injection. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mechanism that fails to properly parse shell syntax. Attackers who can influence model output through prompt injection can execute additional shell commands by appending control operators like semicolons or logical operators to approved commands, bypassing the session approval requirement.

Electron is a framework for building desktop apps. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorker for its Web Workers even when the unsandboxed embedder had Node.js integration disabled. This allowed untrusted guest content to create a Node-enabled worker with more privilege than the embedder granted.

Electron prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 had an issue where responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom scheme with supportFetchAPI enabled but corsEnabled disabled could remain script-readable across origins. This residual issue completes the remediation for CVE-2026-70604.

Electron prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5 did not inherit active HTML sandbox restrictions for windows opened from a sandboxed top-level document. Untrusted content in such a document that was allowed to open popups could create a window with the Electron application's full origin instead of the restricted origin intended by the sandbox.

Electron prior to 41.10.4, 42.5.2, and 43.0.0 did not pass inherited HTML sandbox restrictions to popups opened from a sandboxed iframe through Electron's OpenURLFromTab navigation path, including links using target="_blank" or a middle-click. An untrusted iframe using the allow-scripts allow-popups configuration could open a popup with the embedding application's full origin, exposing that origin's cookies, storage, and same-origin scripting capabilities.

SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Mooncake KV transfer backend. Unauthenticated attackers can send concurrent requests with identical bootstrap_room values to crash scheduler processes or hang other users' requests until transfer timeout.

In libsoup, when reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash.

In libsoup, when handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the documented GBytes API can trigger heap corruption or a crash upon receiving a crafted Pong.

Joomla Extension Balbooa Forms before 2.4.3.4 has an unauthenticated path traversal vulnerability that exfiltrates local files through auto-reply attachments. During public form submission, upload-field state is accepted as Guest-controlled JSON. For every object whose 'id' merely looks numeric, the component trusts the supplied 'filename', concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal 'auto reply' and 'attach uploaded files' options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as '../../../../configuration.php' and receive any file readable by the Joomla process.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows data excavation. Affects versions from * before 1.46.1, 1.45.5, 1.43.10.

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows excessive allocation. Affects versions from 1.46.0 before 1.47.0.