CVE Vulnerability Catalog

fastify from 5.8.3 up to but not including 5.12.1 has a vulnerability related to insufficient protection of forwarded headers when using the numeric form of trustProxy. The guard added in the fix for CVE-2026-3635 checks the connecting address, but the hop-count form compiles to a predicate that structurally ignores the address, so the guard is always satisfied for any hop count of one or more. Applications configured with a numeric trustProxy value, such as 1, remain vulnerable: an attacker who can reach the Fastify origin directly, bypassing the front-facing proxy, can spoof the forwarded request fields exactly as in the unpatched version. The impact includes host injection in generated URLs, HTTPS-enforcement bypass, secure-cookie and CSRF-origin bypass, and host-based routing and cache poisoning.

A vulnerability in the Zephyr kernel affects the k_thread_join() and k_thread_abort() system calls. An error in access validation (thread_obj_validate()) allows an unprivileged user thread to invoke these functions on a thread object it does not own. Instead of terminating the offending thread, execution reaches undefined behavior, potentially causing a kernel crash (on Clang) or an access-control bypass (on GCC).

Pydio Cells 5.0.0 through 5.0.2 exposes share-link details to any authenticated user. The REST handler for GET /a/share/link/{Uuid} lacks authorization checks, and the workspace UUID is not secret as it is embedded in the public page. An attacker with a standard user role can obtain the link hash, URL, owner ID, hidden login, permissions, download limits, target users, expiry, and password-required flag.

A SQL injection vulnerability has been detected in EasyReport up to 2.0.17.0522_Beta, in ModuleController.java, within Move Operations. Manipulation of the sourcePath argument allows remote attack. The exploit has been publicly disclosed, and the project has not responded.

Plainpad through 1.1.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to send unbounded login requests to the POST /v1/sessions endpoint. Dead code in App\Http\Kernel.php leaves the throttle configuration unattached. Attackers can also cause CPU exhaustion via repeated bcrypt comparisons.

Lemur prior to 1.9.3 has a vulnerability in CertificateExport where the CertificatePermission ownership check was inside the plugin.requires_key branch. A plugin with requires_key false bypassed the check, and the handler still passed the private key and logged a key_view audit event. The fix does not pass private keys to plugins that do not require them.

Lemur prior to 1.9.3 did not require AuthorityPermission on the parent authority when creating a sub-CA if ADMIN_ONLY_AUTHORITY_CREATION was false. An authenticated non-read-only user could create a sub-CA and use the parent's private key to sign a new intermediate, allowing issuance of trusted certificates outside normal controls.

FUXA version 1.3.2 and earlier does not check isSocketAdminAuthorized for certain Socket.IO events (DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, DEVICE_TAGS_REQUEST) when secureEnabled is true. A remote unauthenticated or guest user can collect system-discovery information not required for normal HMI viewing.

FUXA version 1.3.2 and earlier allows an authenticated non-admin user to control property.address in the device-webapi-request handler, causing the FUXA server to issue outbound HTTP/HTTPS requests and return the response to the attacker. This leads to an SSRF vulnerability.

ZEBRA prior to 4.5.0 can be terminated by a malicious block producer by placing the same shielded transaction in a non-finalized parent block and its child. The uniqueness assertion is reachable before contextual validation, and release builds use panic=abort, terminating the process.

ZEBRA prior to 4.5.0 can be permanently halted by a consensus-valid block containing a long chain of transparent self-spends. The credit-first ordering can cause the intermediate balance to exceed MAX_MONEY, leading to a panic in release builds. The block is accepted by zcashd, so the halt persists after restart.

ZEBRA prior to 4.5.0 can be slowed down by a malicious P2P peer that answers getblocks/FindBlocks with a small inventory and serves a block with coinbase height far above the local tip. The error is not attributed to the peer, causing cancellation of downloads and a 67-second sync delay. The peer is not scored or disconnected, so it can repeat the attack.

ZEBRA is a Zcash node written in Rust. Prior to 4.5.0, an unauthenticated P2P peer can cause the mempool download pipeline to retain transactions after the RATE_LIMIT_DELAY timeout. This leads to unbounded memory growth and potential node crash.

ZEBRA is a Zcash node written in Rust. Prior to 4.5.0, a chain fork can leave stale Sapling and Orchard note-commitment subtree roots in Zebra state. This can lead to incorrect subtree roots served to consumers like lightwalletd, causing wallet sync failures.

ZEBRA is a Zcash node written in Rust. Prior to 4.5.0, one unauthenticated P2P peer can monopolize all 25 MAX_INBOUND_CONCURRENCY slots in the inbound mempool download pipeline. This can cause honest transactions to be rejected with MempoolError::FullQueue.

ZEBRA is a Zcash node written in Rust. Prior to 4.5.0, an attacker authenticated to an enabled RPC endpoint can terminate zebrad by supplying a getblocktemplate LongPollId with multi-byte UTF-8 characters. This triggers a Rust panic, and release builds use panic=abort, killing the process.

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service.

Dell Alienware Command Center (AWCC) versions prior to 6.14.20.0 contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could exploit this to cause Denial of Service and Elevation of Privileges.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler do not consistently enforce admin permissions. An authenticated non-admin operator can create or alter deviceActions or delete schedules, gaining access to device-value changes and server-side script execution.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the escapeTdString function does not escape backslashes, allowing a remote unauthenticated attacker to inject SQL via crafted sids tag identifiers. This can expose historical PLC tag values and device names.