CVE Vulnerability Catalog

On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when it points outside the root.

U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled, allowing a malicious NFS server to overflow the 2048-byte nfs_path_buff buffer by returning multiple relative symlink targets without cumulative length validation.

Vulnerability in U-Boot up to version 2026.04-rc3 in the tcp_rx_state_machine() function in net/tcp.c. Sending a crafted TCP SYN+ACK packet with a manipulated data offset field causes an integer underflow, leading to bootloader crash and potential memory corruption.

OpenVPN Access Server versions 2.7.2 through 3.1.0 accept bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggling when deployed behind a reverse proxy.

In Immutable.js prior to versions 4.3.9 and 5.1.8, Immutable.Map and Immutable.Set store keys sharing the same 32-bit hash in a linearly scanned HashCollisionNode collision bucket. An attacker controlling keys inserted into a Map (e.g., via Immutable.Map(obj), Immutable.fromJS(obj), state.merge(userObject), or mergeDeep) can craft many colliding keys, degrading insertion and lookup to consume disproportionate CPU.

The node-tar library before version 7.5.18 accepts a tar header with a negative base-256 encoded entry size, causing the archive scanner to make no progress while repeatedly parsing the same header.

The node-tar library before version 7.5.19 does not enforce hard upper bounds on total decompressed data, entry counts, or decompression ratio during extraction and parsing. This allows a small crafted gzip bomb to exhaust disk space and CPU.

A vulnerability in the js-yaml library (JavaScript YAML parser and dumper) causes quadratic CPU time growth when processing YAML documents containing a chain of mappings with merge keys. The issue affects versions from 3.0.0 to 3.14.0 and from 4.0.0 to 4.2.0.

A vulnerability in Socket.IO (versions 4.1.0 through 6.6.7) affects the Engine.IO v4 protocol polling transport. Improper closure of HTTP responses for invalid binary POST requests with Content-Type: application/octet-stream allows an unauthenticated attacker to exhaust server-side connections and sockets.

A vulnerability in Socket.IO (versions 6.5.0 through 6.6.7) allows a DoS attack by sending a crafted session ID (e.g., __proto__) during the WebTransport upgrade process. The bug causes a TypeError, leading to server crash.

A vulnerability in the Copier library (versions 9.5.0 through 9.15.1) allows bypassing the trust mechanism for templates. The prefix check uses raw `str.startswith` without path normalization, while template fetching normalizes the path, enabling `..` sequences to point to a different, attacker-controlled template. Consequently, code from `tasks`, `migrations`, or `jinja_extensions` executes without a trust prompt.

IBM API Connect versions 12.1.0.0 through 12.1.0.3 use default credentials, which could allow an attacker to gain unauthorized access to the application before the system enforces a credential update.

Repomix contains a local file inclusion vulnerability in the git clone endpoint that allows unauthenticated attackers to read arbitrary local git repositories. The isValidRemoteValue function in src/core/git/gitRemoteParse.ts fails to block file:// URLs, permitting attackers to supply file:// scheme URLs that bypass validation and are passed directly to git clone, enabling unauthorized access to all tracked file contents on the server filesystem.

SeaweedFS before version 4.34 does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy. This allows an authenticated user with access to one bucket to read objects from other buckets through server-side copy.

In Frigate 0.17.1, the GET /api/logs/{service} endpoint allows any authenticated user, including the viewer role, to download Frigate and nginx logs. These logs may expose auto-generated admin passwords and camera credentials, enabling viewer-to-admin privilege escalation.

A vulnerability in App::Ack through version 3.10.0 for Perl causes unsanitized terminal escape sequences from filenames to be printed in several output modes. When ack prints a filename containing terminal control bytes like ANSI escape sequences, those bytes reach the terminal unchanged. Version 3.10.0 added a _safe_filename helper that sanitizes filenames in -f, -g, colored match heading, and per-match lines, but the --show-types, -l/-L, and -c paths still emit the raw filename.

A vulnerability in App::Ack for Perl before version 3.10.0 allows memory exhaustion via an unbounded context value in a project .ackrc. Ack searches the directory hierarchy for .ackrc and loads its options, where -B and -C accept any positive integer, potentially allocating a huge buffer.

A vulnerability in App::Ack for Perl (up to version 3.10.0) allows reading arbitrary files via the --files-from option in a project .ackrc file. Ack searches the directory hierarchy for .ackrc and loads its options, but the option blocklist does not include --files-from, enabling a malicious repository to read files outside the project.

An OS command injection vulnerability exists in the start_lltd() function of the "rc" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W routers (firmware 1.2.2.5/1.2.2.8). The machine_name configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary commands with root privileges.

An OS command injection vulnerability exists in the sub_34984() function of the "rc" binary in Cisco RV130/RV130W (firmware 1.0.3.55) and RV110W routers (firmware 1.2.2.5/1.2.2.8). The lan_ipv6_prefixlen configuration parameter is not properly sanitized, allowing an authenticated remote attacker to execute arbitrary OS commands with root privileges.