CVE Vulnerability Catalog

The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow authenticated users to execute arbitrary OS commands via concatenated params on a crafted POST request for the endpoint /cgi-bin/device-management-utilities-internet.cgi.

In dd-trace-cpp prior to 2.1.0, parsing incoming W3C baggage headers does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated attacker can send a header with many key-value pairs or one very large value, causing unbounded CPU and memory consumption.

In Datadog PHP Tracer prior to 1.19.2, ddtrace_deserialize_baggage parses incoming W3C baggage headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES. A remote unauthenticated client can send many key-value pairs or one oversized value, causing unbounded CPU and memory consumption.

In OpenSlide from 3.4.1 until 4.0.1, parse_level0_xml() processes a crafted Ventana BIF file accepting nonpositive row or column tile counts. The invalid counts produce attacker-controlled memory offsets and allow arbitrary writes, resulting in a crash or potential arbitrary code execution.

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted archive can chain relative symlinks to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside it, which then runs with Grafana server privileges.

NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN connection creation permissions to inject arbitrary pppd directives by supplying mru or mtu property values containing trailing non-numeric content after a valid integer. Attackers can exploit the verbatim write of unvalidated strings into the pppd options file via write_config_option() to inject the plugin directive, causing the privileged pppd process to load an attacker-controlled shared object and achieve arbitrary code execution as root.

AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 on Python 3.7 and later has improper certificate validation with host mismatch in the MQTT client TLS connection layer. An adversary-in-the-middle can impersonate the AWS IoT Core endpoint, read telemetry, and inject arbitrary MQTT messages.

In Valhalla (an open source routing engine for OpenStreetMap data) version 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points causes unbounded memory growth in the worker. The zero-area geometry triggers processing in src/loki/polygon_search.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can stop a public-facing worker.

In SAIL before version 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row that the destination buffer cannot hold, resulting in a forward heap overwrite that scales with image height. The issue is fixed in version 1.0.0.

In Pomerium (an identity and context-aware access proxy) before version 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. The issue is fixed in version 0.32.8.

In MKP (a Model Context Protocol server for Kubernetes) before version 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource. buildPodLogOpts() in pkg/k8s/subresource.go parses those values as unbounded int64 parameters, and defaultGetPodLogs() copies the returned Kubernetes log stream through io.Copy into an in-memory bytes.Buffer without an application-side cap. The issue is fixed in version 0.4.1.

In Omni (which manages Kubernetes on bare metal, virtual machines, or in a cloud) from 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The issue is fixed in versions 1.6.6 and 1.7.3.

In Omni before 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The issue is fixed in versions 1.6.6 and 1.7.3.

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.

In Keycloak deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

In uniget (a universal installer and updater for container tools) before version 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. The issue is fixed in version 0.27.6.

In ESPAsyncWebServer (an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350) before version 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. The issue is fixed in version 3.11.1.

In Frappe HR (an open-source human resources management solution) before version 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. The issue is fixed in 16.7.0.

In MCP Documentation Server from 1.13.0 until 1.13.1, the automatically started Web UI listens on all network interfaces (port 3080) instead of localhost by default. An unauthenticated network client can call API endpoints to enumerate, read, search, insert, and delete documents, and to read configuration, thereby tampering with the MCP assistant's knowledge base. The issue is fixed in 1.13.1.

In the Elixir protobuf library from 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes can be taken offline when the schema contains a self-referential or cyclic message type. The decoder recursively processes nested embedded fields without a nesting-depth limit, allowing a relatively small request to consume substantial CPU and memory and pin a BEAM scheduler. The issue is fixed in 0.16.1.