CVE Vulnerability Catalog

A vulnerability in the libp2p JavaScript library prior to version 16.0.0 allowed blocking the Node.js event loop by sending specially crafted IHAVE and IWANT messages. Missing limits in defaultDecodeRpcLimits (maxIhaveMessageIDs and maxIwantMessageIDs set to Infinity) enabled iterating approximately 180,000 message IDs per 4 MB frame, leading to denial of service (DoS).

In OpenCTI prior to version 7.260326.0, an authorization bypass vulnerability allows any authenticated user with KNOWLEDGE_KNUPDATE permission to bypass Confidence Level validation and Object Marking restrictions by injecting the synchronized-upsert: true HTTP header. This enables attackers to downgrade confidence levels, remove security markings like TLP:RED, manipulate relationships, and affect STIX object types including Indicators, ThreatActors, Malware, and Reports.

The DBS Etherwatch file parser in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 crashes, allowing an attacker to cause a denial of service (DoS).

A vulnerability in GitLab CE/EE due to improper sanitization of user-supplied input allows an authenticated user to execute arbitrary scripts in another user's browser session under certain conditions. Affected versions: all from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2.

Multiple buffer overflow vulnerabilities in the User-ID Terminal Server Agent (TSA) component of Palo Alto Networks PAN-OS software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network traffic.

A vulnerability in Bitwarden Server before 2026.6.0 allows a low-privileged organization member to obtain another user's vault key and access token. The attacker creates a Trusted Device Encryption authentication request bound to their own public key, and once approved by the victim, the data is readable from an unauthenticated endpoint, leading to account takeover.

A vulnerability in the Composer dependency manager for PHP allows an attacker to write files outside the vendor directory and project during package installation or update. The issue occurs when a package from an untrusted repository (other than Packagist.org or Private Packagist) uses an invalid name that is not properly validated before dependency-resolution results are written.

The httplib2 Python library before version 0.32.0 does not limit decompression of HTTP responses with gzip or deflate encoding, allowing a malicious server to send a small compressed payload that expands to an arbitrarily large size in memory, causing MemoryError or OOM-kill in the client process.

In pypdf library prior to version 6.14.1, a vulnerability was found causing an infinite loop when processing inline images in PDF page content streams. An attacker can craft a malicious PDF with a not terminated inline image, leading to a hang during text extraction.

The pypdf library prior to version 6.14.2 is vulnerable to a DoS attack due to an infinite loop when parsing PDF files. An attacker can craft a malicious PDF with a not terminated inline image using ASCII85 or ASCIIHex filters, causing the process to hang.

LiteLLM prior to version 1.82.0-stable did not apply proper sandboxing and validation for Custom Code Guardrails during creation and update, allowing a privileged user to execute arbitrary Python code in the proxy environment and potentially expose process secrets.

A vulnerability in Gradio before version 6.20.0 allows open redirect and server-side request forgery (SSRF) via unvalidated URLs in the file_fetch() function at the /gradio_api/file= endpoint. Attackers can craft a malicious FileData response to access internal endpoints such as cloud metadata services to steal sensitive credentials, including EC2 IAM role credentials.

A denial-of-service vulnerability in rpcx through version 1.9.3 allows an unauthenticated attacker to send a small gzip-compressed message that decompresses to gigabytes, causing out-of-memory conditions and service unavailability. The issue is in protocol.Message.Decode, where decompressed size is not limited, and the MaxMessageLength check only applies to the compressed frame size.

A vulnerability in PasswordPusher before version 2.8.1 allows data URI schemes in URL push payloads due to insufficient validation in the valid_url function. Attackers can craft malicious pushes with data:text/html URIs that execute arbitrary JavaScript in victims' browsers when clicked, enabling phishing and credential theft under the trusted PasswordPusher domain.

In NATS Server, when no_auth_user is configured, a parser fast path intended for ordinary client connections could also apply to route or leafnode listeners, allowing an unauthenticated peer to bypass inter-server CONNECT authentication and operate with the privileges associated with that connection type.

In NATS Server before versions 2.12.8 and 2.11.17, an unauthenticated peer with network access to a leafnode listener with compression enabled could crash the server by sending repeated leafnode INFO protocol messages before authentication and account setup completed.

A vulnerability in the NATS Server allows an MQTT client to inject protocol control characters into subscription filters, which are later forwarded as NATS protocol data to route or leafnode connections, potentially corrupting the protocol stream and enabling unauthorized NATS operations.

An unauthenticated MQTT client can cause the NATS server to retain large incomplete MQTT CONNECT packets before authentication completes, consuming server memory while waiting for the advertised packet length. This affects versions prior to 2.14.3 and 2.12.12.

A path traversal vulnerability in Handlebars.java allows arbitrary file read. Applications passing user-controlled input to Handlebars.compile() with FileTemplateLoader or ClassPathTemplateLoader are affected.