CVE Vulnerability Catalog

A directory traversal vulnerability in Spring Cloud Config allows attackers to access arbitrary files via a crafted URL. The issue affects the spring-cloud-config-server module serving text and binary files.

Gotenberg is a stateless API for PDF files that in versions 8.30.1 and earlier improperly validates metadata values. These values can contain newline characters, allowing injection of arbitrary ExifTool pseudo-tags, leading to serious security vulnerabilities.

OpenClaw before 2026.4.22 contains a time-of-check/time-of-use race condition in OpenShell sandbox filesystem writes that allows attackers to redirect writes outside the intended mount root. Attackers can exploit symlink swaps during filesystem operations to bypass sandbox restrictions and write files outside the local mount root.

OpenClaw before version 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback tokens fail open instead of rejecting requests, enabling attackers to bypass signature verification and replay protection to execute arbitrary commands.

OpenClaw before version 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes the Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting the overly broad binding configuration.

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged context than intended.

OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the noVNC helper route that exposes interactive browser session credentials. Attackers can access the noVNC helper route without bridge authentication to gain unauthorized access to the interactive browser session.

A use after free vulnerability in Views in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker who compromised the renderer process to bypass site isolation via a crafted HTML page.

A use after free vulnerability in Fullscreen in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials.

Vulnerability in Apache::Session::Generate::ModUniqueId versions 1.54 through 1.94 for Perl causes session IDs to be generated based on the UNIQUE_ID environment variable from Apache mod_unique_id. The ID relies on IPv4 address, PID, epoch time, a 16-bit counter, and thread index, with no obfuscation, making it predictable.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns passing flow_id to the set_rps_cpu() function, which may lead to out-of-bounds access and system crashes.

A race condition was found in the Linux kernel's tcp_v6_syn_recv_sock() function. After tcp_v4_syn_recv_sock() returns, the child socket is already visible in the TCP ehash table, but the pinet6 pointer still points to the listener's structures, potentially causing issues.

In the Linux kernel, a vulnerability was found in netconsole where the message passed from the console subsystem is not guaranteed to be null-terminated, leading to out-of-bounds reads. KASAN reported a slab-out-of-bounds error during message processing.

In the Linux kernel, __ioam6_fill_trace_data() on the IPv6 IOAM receive path fails to validate trace->nodelen against trace->type. A crafted packet can set nodelen=0 while setting type bits 0-21, causing a write of about 100 bytes past the allocated region (into skb_shared_info), corrupting adjacent heap memory and leading to a kernel panic.

In the Linux kernel, the dlm_search_rsb_tree function lacks validation of the len parameter from network messages. When exceeding DLM_RESNAME_MAXLEN, it can cause an out-of-bounds write.

W jądrze Linuxa rozwiązano podatność związaną z systemem plików btrfs, która występowała w funkcji btrfs_sync_file(). Użycie overlay na btrfs prowadziło do błędnego przypisania superbloku, co mogło skutkować awarią systemu.

In the Linux kernel, the AVX2 implementation for pipapo sets in netfilter has a bug that returns non-matching entries on expiry. The issue occurs when AVX2 match functions process the last field without consuming the entire input, leading to false element collision reports.

W jądrze systemu Linux zidentyfikowano podatność, która prowadzi do dostępu poza granice tablicy dev->_tx[], gdy trace->type.bit6 jest ustawione, a is_input jest prawdziwe. Problem ten występuje, gdy urządzenie wejściowe ma więcej kolejek RX niż urządzenie wyjściowe TX.