CVE Vulnerability Catalog

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.

Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

DIRAC's PilotWrapper.py downloads the second-stage pilot.tar archive and its reference checksum without TLS certificate verification, using ssl._create_unverified_context. An attacker able to redirect or intercept network traffic (e.g., via DNS or routing manipulation) can substitute both the pilot code and its checksum, leading to arbitrary code execution with access to pilot proxy credentials. Fixed in versions 8.0.79, 9.0.22, and 9.1.10.

In the githubtoplanguages repository, the .github/workflows/discord-issue.yml workflow interpolates the issue title (github.event.issue.title) directly into the Bash assignment for ISSUE_TITLE before shell parsing. An issue title containing shell command-substitution syntax can execute commands on the GitHub Actions runner, potentially allowing manipulation of bot notifications or exposure of the Discord webhook secret. Fixed by commit 6bf9c3a9cb66c937b9047ca266b3d02f2bb11027.

In mcp-searxng before 1.7.1, web_url_read accepts a caller-controlled URL and validates only the literal hostname in assertUrlAllowed() before undiciFetch() performs OS DNS resolution. A public-looking attacker-controlled hostname that resolves to a private, loopback, link-local, or cloud-metadata address passes the lexical check and causes the MCP server to connect to the internal destination. In the default HTTP configuration, an unauthenticated network client can read internal services, expose credentials or tokens, and enumerate reachable internal hosts. Fixed in version 1.7.1.

In mcp-searxng before 1.7.1, web_url_read passes a caller-supplied URL to readUrlContent(), where checkContentLength() treats a missing Content-Length header as an inconclusive preflight and the normal and error paths then consume the complete body with response.text(). A server that omits Content-Length can bypass URL_READ_MAX_CONTENT_LENGTH_BYTES and force unbounded memory use, and the resulting string is processed by NodeHtmlMarkdown.translate(), increasing CPU consumption. An unauthenticated HTTP client can cause denial of service. Fixed in version 1.7.1.

In MCPVault before 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing filesystem-equivalent segment names. On case-insensitive macOS and Windows filesystems, case variants of .git, .obsidian, or node_modules pass both isAllowed() and isAllowedForListing() even though the operating system opens the restricted directory, and Windows trailing dots or spaces provide the same bypass. An attacker who influences a path selected by an AI agent can expose or modify sensitive repository and Obsidian metadata. Fixed in version 0.11.4.

In Shopper before 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without edit_product_variants authorization and leaves public $variant client mutable because it lacks the Livewire Locked attribute. Any authenticated admin-panel user, including staff with only browse_products, can select an arbitrary product variant and inventory location through component state, then submit a positive or negative quantity adjustment. This permits browse-only staff to inflate stock, reduce stock, or force out-of-stock states for variants outside the current page. Fixed in version 2.9.2.

In Shopper before 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, Tag/Index.php, Brand/Index.php, Category/Index.php, and Supplier/Index.php omit server-side authorization while the pages require only browse_attributes, browse_tags, browse_brands, browse_categories, or browse_suppliers. A browse-only staff user can invoke DeleteBulkAction to mass delete attributes or tags and can invoke BulkAction::make('enabled') or BulkAction::make('disabled') to change attribute, brand, category, or supplier visibility. These operations can break product variants and substantially disrupt storefront catalog visibility. Fixed in version 2.9.2.

In Shopper before 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('delete') and DeleteBulkAction::make() without delete_collections authorization, while public Collection $collection remains client mutable because it lacks the Livewire Locked attribute. An authenticated staff user with only browse_collections can invoke a Livewire removal action, substitute an arbitrary collection identifier, and detach selected products or empty the collection. This can disrupt catalog landing pages and promotions associated with the targeted collection. Fixed in version 2.9.2.

In Strimzi 1.0.0 and earlier, an attacker who can create a Kafka custom resource can set Kafka.spec.entityOperator watchedNamespace to a target namespace, causing the Cluster Operator to create a Role with full Secret CRUD permissions there and bind it to the Entity Operator ServiceAccount in the attacker's namespace. The attacker can mint a token for that ServiceAccount and read or write Secrets in any target namespace where the Cluster Operator has been granted permissions, regardless of STRIMZI_NAMESPACE. Fixed in versions 1.0.1 and 1.1.0.

In Meta Ads MCP before 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py passes an attacker-controlled image_url to try_multiple_download_methods() in meta_ads_mcp/core/utils.py, where httpx.AsyncClient uses follow_redirects=True and performs HTTP requests without validating the scheme, host, or resolved IP address. In a streamable-http deployment, a network caller can use any non-empty authorization value because Meta credential validation occurs after the image download, then direct the server to loopback services, private-network addresses, cloud metadata endpoints, or redirect-chained internal targets. The resulting server-side request forgery can expose internal data, invoke state-changing internal services, or disrupt reachable services. Fixed in version 1.0.115.

Meta Ads MCP prior to version 1.0.115 contains a flaw in AuthInjectionMiddleware that rejects HTTP requests only when both tokens are absent, while extract_token_from_headers() does not recognize X-Pipeboard-Token as a primary credential. A remote caller using the streamable-http transport can send any X-Pipeboard-Token value, bypass the guard, and cause the server to fall back to the operator's META_ACCESS_TOKEN.

netty-incubator-codec-ohttp prior to 0.0.23.Final allocates a pooled direct ByteBuf for decrypted plaintext before the AEAD tag is verified. When an invalid tag causes a CryptoException, the buffer is not released, leading to native off-heap memory leaks on repeated invalid requests.

MitraStar GPT-2742GX4X5v6-SV version GL_g2.5_100XNT0b23_3 contains a vulnerability in the /cgi-bin/device-management-utilities-internet.cgi component that allows an authenticated attacker to execute arbitrary code.

OpenCost prior to 1.121.0 exposes the POST /serviceKey endpoint, allowing a network client to invoke AddServiceKey without mandatory authentication and write an arbitrary key value to the GCP service-account key.json file. The attacker controls the file contents but not the directory, filename, or file mode.

CrowdStrike released a security update for the Falcon sensor for Windows addressing a vulnerability that exists only when the Microsoft Office File Malicious Macro Removal Windows policy setting is enabled. The vulnerability could expose an arbitrary file write to protected locations from an unprivileged context, potentially leading to local privilege escalation.