CVE Vulnerability Catalog

A logic flaw in Wazuh Manager versions 4.0.0-4.10.3 and 4.11.0-4.14.4 affects the enrollment daemon (authd) and synchronization daemon (remoted). The authd process allows agents to select a group during enrollment without filtering path traversal sequences like "..", enabling access to files outside the intended directory. Sensitive files such as client.keys, ossec.conf, and internal certificates are exposed to the attacker.

In Wazuh versions 1.0.0 through 4.14.4, a heap buffer overflow in wazuh-analysisd allows an unauthenticated remote attacker to crash the analysis engine. By exploiting the default configuration, an attacker can inject crafted rootcheck events, causing a buffer overflow and stopping all SIEM alert processing while the dashboard and API show stale data.

The h2o HTTP server prior to commit 6b5370d is vulnerable to a Denial of Service attack due to excessive stack memory allocation via alloca. When serving static files, the allocation size can reach ~600KB, exceeding the default pthread stack size in musl libc (128KB), causing a segmentation fault and server crash.

Quicly, the QUIC implementation in H2O, before commit 8b178e6 is vulnerable to a DoS attack via connection state corruption. The library accepts Connection IDs up to 255 bytes, but CID buffers are limited to 20 bytes, leading to buffer overrun and assertion failures.

In the Quicly IETF QUIC protocol implementation, primarily used within the H2O HTTP server, an assertion failure occurs prior to commit 937d0e9. The failure is triggered when the total number of valid handshake messages received over a CRYPTO stream in a single packet number space exceeds 32KB, causing a Denial of Service (DoS).

In wger prior to version 2.6, a gym trainer can escalate their session to any higher-privileged account (gym manager, general manager) by chaining two calls to the trainer-login endpoint. After a legitimate switch to a low-privileged user, the session flag `trainer.identity` is set and bypasses permission checks on subsequent trainer-login calls.

In wger versions prior to 2.6, an authenticated user can read another user's private workout notes, exercise history, and training statistics by calling the /logs/ and /stats/ actions on a routine they do not own. The vulnerability is due to incorrect permission checks in RoutineViewSet, which grants read access to any authenticated user when the routine has is_template=True.

Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

A vulnerability in YAML::Syck for Perl before version 1.47 allows an out-of-bounds read via an unbounded newline scan in the newline_len function. The issue occurs during block-scalar lexing at a document boundary, where the scan runs one byte past the heap lexer buffer.

A heap use-after-free vulnerability exists in YAML::Syck for Perl before version 1.47. The issue occurs when an anchor name is reused as a key in the anchors table in syck_hdlr_add_anchor, leading to reading freed heap memory.

A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.

In Kirby CMS versions prior to 4.9.1 and 5.4.1, a vulnerability was found where URL methods for KirbyTags and image blocks components did not filter malicious URL values that resolve to script execution. Attackers can use URL formats like `javascript://x%0A…` to bypass protection against simple `javascript:` URLs and execute scripts.

In Kirby CMS versions 5.3.0 through 5.4.0, a path traversal vulnerability was found due to improper validation of user IDs. An attacker could include arbitrary PHP files named index.php and probe the server's directory structure.

Kirby CMS versions prior to 4.9.1 and 5.4.1 do not properly sanitize the list field content on save, allowing XSS attacks. An attacker can bypass the Panel and send malicious HTML directly to the API, which will be executed in visitors' browsers.

Kirby CMS before versions 4.9.1 and 5.4.1 does not validate model attributes used in collection queries, allowing attackers to invoke arbitrary model methods. This can lead to disclosure of sensitive data (e.g., password hashes, filesystem paths) or execution of impactful actions (e.g., privilege escalation, mass deletion of models).

WWBN AVideo versions 29.0 and below are vulnerable to OS command injection. The fix for CVE-2026-33482 was incomplete and does not neutralize a single & (shell background operator), allowing multiple commands to be chained.

A time-of-check to time-of-use (TOCTOU) race condition in the installation and uninstallation process of certain Zoom Clients for Windows could allow an authenticated local user to escalate privileges.

Improper privilege management in Zoom Rooms for Windows before version 7.1.0 allows an authenticated user to escalate privileges via local access.

Docling Core versions 1.5.0 through 2.74.1 insufficiently restricted remote request destinations and unsafely processed Content-Disposition headers, allowing access to local files outside the cache directory. This vulnerability enables SSRF attacks in applications that accept untrusted URLs.