CVE Vulnerability Catalog

A vulnerability in the hoek library before version 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function. An attacker can exploit this flaw to modify object prototypes, leading to unauthorized access or code execution.

A vulnerability in Go's HTTP/2 implementation allows a malicious client to rapidly create and reset requests, causing excessive server resource consumption. Although the number of concurrent streams is limited by MaxConcurrentStreams, resetting requests enables the attacker to continuously send new requests.

CPAN.pm before version 2.35 does not verify TLS certificates when downloading distributions over HTTPS. This allows man-in-the-middle attackers to replace downloaded packages with malicious ones.

The pip package before version 19.2 for Python is vulnerable to directory traversal when a URL is provided in an install command. An attacker can exploit a Content-Disposition header containing '../' in the filename to overwrite files, such as /root/.ssh/authorized_keys.

Vulnerability in CPAN 2.28 allows signature verification bypass. An attacker can supply unauthorized code that is treated as properly signed.

A vulnerability was found in systemd where a service using the DynamicUser property can create a SUID/SGID binary that remains executable with the transient service UID/GID even after the service terminates. A local attacker could exploit this to access resources owned by a potentially different UID/GID.

The filepath package in Go does not recognize paths with a \??\ prefix as special. On Windows, a path starting with \??\ is equivalent to a path starting with \\?\ and can be used to access arbitrary system locations.

The KeyTrap vulnerability in the DNSSEC protocol allows a remote attacker to cause a Denial of Service (DoS) by sending DNSSEC responses containing many DNSKEY and RRSIG records. This leads to excessive CPU consumption on the DNS server, potentially causing overload.

Dalli's meta protocol request formatter writes some numeric arguments into memcached commands without converting them to integers. If an application passes an attacker-controlled String to one of these arguments, CRLF sequences in it are sent to memcached as additional commands on the same connection.

@tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated __QUOTED_0 prefixes. Inline shortcode attributes use another unanchored expression, which can lead to resource exhaustion.

A rogue MySQL server (or a man-in-the-middle) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

Several vulnerabilities (two rated critical under CVSSv3) have been discovered and fixed in the upstream libheif dependency. They can lead to remote code execution (RCE) on glibc-based Linux under certain conditions.

Nodemailer's address parser parses comma-separated addresses in quadratic time (O(n²)) in the number of addresses. A single crafted address string (e.g., To, Cc, Bcc, From, Reply-To) can cause significant slowdown.

The wheels of pyca/cryptography include a statically linked copy of OpenSSL. The versions of OpenSSL included in wheels prior to cryptograph 48.01 are vulnerable to a security issue.

In applications using OAuth::Consumer to request OAuth 1.0 tokens, the token request helper follows 300..399 redirects returned by the OAuth server. In affected versions, OAuth::Consumer#token_request parses the raw Location header and recursively follows the redirect.

A vulnerability in the libtiff library related to handling the SamplesPerPixel tag allows an attacker to cause a denial of service (DoS). Package updates are available for Amazon Linux 2023 that fix this issue.

An issue was discovered in py-lmdb 0.97 where mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. This occurs when accessing a data.mdb file supplied by an attacker.

A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.

A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.

Podatność dotyczy niektórych pakietów React Server Components w wersjach 19.x oraz frameworków, które używają tych pakietów, w tym Next.js w wersjach 13.x, 14.x, 15.x i 16.x korzystających z App Router. Problem jest śledzony w systemie jako CVE-2026-23870.