CVE Vulnerability Catalog

JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a stored XSS vulnerability in the classic project overview. This may allow script execution in a user's browser.

JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a remote code execution vulnerability via a whitelist bypass in the build messages protocol. This may lead to arbitrary code execution on the server.

JetBrains Datalore before version 2026.2.1 contains an unauthenticated path traversal vulnerability via the report blob endpoint, allowing reading of arbitrary files. This may lead to disclosure of sensitive information.

In JetBrains YouTrack before 2026.2.19575, 2026.3.16075, 2026.3.16397, and 2026.3.16402, mail rules allowed a project admin to execute cross-project issue commands. This violates the isolation of permissions between projects.

JetBrains Junie CLI before version 26.8.3 contains a code execution vulnerability via an untrusted project's MCP server configuration. This may lead to arbitrary code execution in the user's context.

A heap-based buffer overflow exists in Wavlink WN530HG4B (M30HG4B_V260724) in the file api.cgi. The attack can be launched remotely and the exploit has been made public.

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process while the tree was being freed.

A server-side template injection (SSTI) vulnerability exists in SolusVM 2 up to version 2.0.0-44576, allowing remote authenticated users to execute arbitrary code as root.

In kin-openapi prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest.

In kin-openapi from 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc.

In kin-openapi from 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for the same parameter-name regular expression inside the per-query-key loop in urlValuesDecoder.DecodeObject. An unauthenticated remote client can send a request with many unrelated query keys, causing resource consumption proportional to the attacker-controlled key count. This is not regular expression denial of service; the consumption comes from loop-invariant recompilation.

In kin-openapi prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header.

In kin-openapi prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolving a self-referential additionalProperties JSON Reference. Loading an attacker-controlled OpenAPI document through LoadFromData, LoadFromFile, or LoadFromURI reaches resolveComponent before document validation and can panic the loading process.

In kin-openapi prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, which passes an unsupported or non-canonical HTTP method for an existing static path to openapi3.PathItem.GetOperation. The default branch of GetOperation panics before authentication runs, so an unauthenticated remote client can repeatedly send methods such as PROPFIND or lowercase get to abort connections and generate stack-trace log growth.

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source.

An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control in the handling of intent:// URLs in DefaultWebClient.

An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.

In HPE NonStop SQL/MX EXE, a corrupted file may cause an out-of-bounds read under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption.

A buffer overflow vulnerability in HPE NonStop RDMA SERVICES NSK may cause an out-of-bounds memory write, which may result in memory corruption.

A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.