CVE Vulnerability Catalog

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and bootstrap.servers to exfiltrate the console-api ServiceAccount token to an attacker-controlled broker.

Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI clients. Prior to version 5.1.0, the dashboard HTTP server in token-optimizer-mcp exposes /api/session-summary and /api/session-events with no authentication middleware — any network-accessible client can reach them without credentials. Both handlers concatenate the caller-supplied sessionId query parameter directly into a filesystem path via path.join, and Node.js normalizes .. segments at resolution time, allowing an unauthenticated attacker to read any .jsonl file reachable from the server's filesystem. This issue has been patched in version 5.1.0.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can reach an on-link host outside the intended trust boundary. This issue is fixed in version 10.5.1.

ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside the intended range as contained. This issue is fixed in version 10.7.1.

The ip-address library before version 10.7.1 accepts unbounded strings in the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts, expanding invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-parser defaults, generally constrain the effect; megabyte-scale fields can cause a synchronous stall and high transient memory use, approximately 16 MiB can trigger an invalid string length exception, and process termination occurs at approximately 32 MiB.

In the ip-address library from version 10.2.0 to 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-use range.

In Axios from version 1.7.0 to 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. Attacker-controlled request headers can alter authorization, caching, metadata-service access, or application-specific behavior.

In Axios from version 1.0.0 to 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream request processing can observe attacker-controlled headers, including authorization-related values.

In Axios from version 0.27.2 to 0.34.0 and 1.20.0, default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read-side gadget in axios request dispatch.

In Axios from version 1.12.0 to 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch adapter request. Attacker-controlled headers can alter authorization, cache, metadata-service, or application-specific request behavior.

A vulnerability found in deepseek-ai deepseek-harness up to 0.1.0-rc.7 affects the run_code function of the Code Mode Sandbox component. Manipulation leads to a sandbox issue, and the attack can be executed remotely. The vendor's own code, SAFETY.md, and design notes explicitly state the worker is "containment, not a security boundary".

A vulnerability in ag-ui-protocol ag-ui up to 2026-09-07 affects the JSON.parse function in the file legacy/convert.ts of the Middleware component. Manipulation leads to an uncaught exception, and remote exploitation is possible. Upgrading to version 2026-09-08 addresses the issue.

A flaw in ag-ui-protocol ag-ui up to 2026-09-07 affects the FilterToolCallsMiddleware function in the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the Middleware component. Executing a manipulation can lead to incomplete cleanup, and the attack may be launched remotely. Upgrading to version 2026-09-08 resolves the issue.

A vulnerability in ag-ui-protocol ag-ui up to 2026-09-23 affects an unknown part of the file SseParser.kt in the Kotlin Community SDK component. Manipulation results in handling of exceptional conditions, and the attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first; an integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.

A vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. The readAllBytes function in JdkAgentHttpHandler.java of the HTTP Handler component leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.

A vulnerability has been detected in PMWeb v7.x/v8.x/v2025.x. An unknown function in the encryptionhelper.dll library leads to information disclosure. The attack may be launched remotely. The vendor did not respond.

A weakness has been identified in PMWeb 7.x/8.x/2025.x. Unknown processing in downloader.aspx with the FullFileName/FileName argument causes path traversal. The attack may be initiated remotely. The exploit is publicly available. The vendor did not respond.

Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cache at will.

Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() vulnerability in schema.py that allows authenticated attackers to achieve code execution by placing a Python object with a malicious __repr__ method into component input options lists.