CVE Vulnerability Catalog

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows data excavation. Affects version 1.47.0-alpha.

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metacharacters into the alias parameter to execute arbitrary commands on the server.

urllib3 versions from 1.10.3 until 2.8.0 contain an unbounded memory allocation vulnerability. The HTTPResponse.read_chunked and HTTPResponse.stream methods buffer the chunk-size field without a length bound until a newline or EOF is encountered. A malicious HTTP server can send a very long unterminated chunk-size line, leading to exhaustion of the client process memory.

urllib3 versions from 1.26.0 until 2.8.0 fail to keep target-server TLS settings separate from the HTTPS proxy connection. The proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths are affected. Setting cert_reqs=CERT_NONE can overwrite proxy_ssl_context.verify_mode in place, and the mutation persists so later connections may connect to the HTTPS proxy without certificate verification.

TeamViewer Full Client and Host for Linux prior to version 15.82 contain an improper path validation vulnerability in the Cloud Session Recording (CSR) functionality. By exploiting a race condition during path validation and subsequent file access, a local authenticated attacker may cause privileged file operations in unintended locations.

TeamViewer Full Client, Host, and related modules on Windows, Linux, and macOS contain an improper access control vulnerability. An authenticated remote attacker can bypass user-configured permission settings during session establishment by modifying access control parameters for restricted features. This may result in unauthorized actions and potentially lead to remote code execution.

TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A local low-privileged attacker can replace rollback backup files stored in a user-writable temporary directory before they are restored by an elevated installer, resulting in privilege escalation to NT AUTHORITY/SYSTEM.

TeamViewer Full Client and Host for Linux and macOS prior to version 15.82 contain a heap-based buffer overflow vulnerability in the processing of .tvs session recording files. A size mismatch during decompression of recorded session data can result in out-of-bounds heap writes. By convincing a user to open a specially crafted session recording through the "Play or convert recorded session…" feature, an attacker may achieve arbitrary code execution with the privileges of the current user.

A malicious remote peer can flood the local QUIC stack with NEW_CONNECTION_ID frames by bypassing a limit on connection IDs. This causes RETIRE_CONN_ID frames to be sent and, with withheld ACKs, can allocate about 400 MB of memory.

OpenSSL 4.0 contains a use-after-free vulnerability (CWE-416) in the caching of X.509 certificate extensions. When several threads concurrently use the same certificate for the first time, one thread may free the cached extension data while another thread is still using it. This can crash the process, resulting in a Denial of Service.

The DTLS retransmission logic incorrectly handles a handshake message write that is suspended part-way through. The retransmitted message can be read past the message buffer, disclosing heap memory or causing a crash and Denial of Service.

A TLS server that calls SSL_set_SSL_CTX() to switch a connection to a different SSL_CTX part way through a handshake may access memory beyond the end of an internal array if the replacement context knows about more provider signature algorithms than the context the connection was created from. A remote peer may be able to cause a small out-of-bounds read, and in some circumstances a fixed-value out-of-bounds write, on the server heap, potentially leading to a Denial of Service.

A vulnerability in the QUIC implementation in OpenSSL allows a remote attacker to keep allocated packet buffer memory for an extended period by sending specially crafted packets. The issue stems from missing resource allocation limits (CWE-770), potentially leading to excessive memory consumption.

Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 allows a local authenticated user with low privileges to perform arbitrary file writes with elevated privileges (NT AUTHORITY/SYSTEM \ root). By sending crafted IPC commands to the local service daemon, an attacker could manipulate file paths, leading to local privilege escalation.

Prior to version 0.1.1, @socket.io/cluster-engine uses inherited object properties when looking up attacker-controlled session IDs in clustered deployments. Special property names such as __proto__ or constructor can resolve through the object prototype chain instead of identifying an actual connected client, causing the Node.js process to crash and resulting in denial of service. Applications that do not use @socket.io/cluster-engine are not affected.

Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.

Devolutions Server 2026.3.5.0 and earlier stores sensitive information in cleartext in the database. An attacker with read access to the database can obtain external identity provider tokens and active session identifiers.

Weblate 4.11.1 through 2026.7.1 contains an argument-injection vulnerability in its Mercurial backend. Repository filenames beginning with - could be interpreted as Mercurial options instead of literal paths. An authenticated user with project-scoped component.edit permission could exploit this through a Mercurial-backed RESX component using the Update RESX files add-on, potentially executing arbitrary commands with the privileges of the Weblate service account. This issue has been patched in version 2026.8.

Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compressed peer messages containing a decompression bomb, exhausting available memory of the recipient's operating system. This issue has been patched in version 3.3.11.

NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAML configuration file. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.