CVE Vulnerability Catalog

The CWD ~root command in the ftpd server allows root access to the system.

The debug command in Sendmail is enabled, allowing attackers to execute commands as root.

A vulnerability in Perl 5.30.0 through 5.38.0 allows a heap buffer overflow when compiling a crafted regular expression. An attacker can exploit this to cause a controlled buffer overflow.

An issue was discovered in py-lmdb 0.97 where mdb_node_del does not validate a memmove in the case of an unexpected node->mn_hi, leading to an invalid write operation. This occurs when accessing a data.mdb file supplied by an attacker.

A heap buffer overflow vulnerability was discovered in Perl. Affected versions include release branches 5.34, 5.36, 5.38, and 5.40, as well as development versions from 5.33.1 through 5.41.10. When non-ASCII bytes are present in the left-hand side of the `tr` operator, `S_do_trans_invmap` can overflow the buffer.

In Pillow's libtiff encoder (PyImaging_LibTiffEncoderNew in src/encode.c), crafted TIFF tags can cause memory disclosure and a segfault. The issue occurs when creating the LibTiff encoder.

The description of this report does not contain sufficient technical information about the vulnerability — it only includes a note about the reporting method and references to files that were not attached. The nature and scope of the issue cannot be determined from it.

Pillow wheels from 11.1.0 onward bundle a libopenjp2 containing a heap-buffer-overflow write that is fixed upstream on master but has never appeared in an OpenJPEG release. Because the wheel bundles its own copy, a patched host library does not protect against the issue.

A call to the token endpoint with a grant type of urn:ietf:params:oauth:grant-type:device_code and a bogus device_code can obtain a bearer token as long as a valid client ID enabled for the device workflow is known. This violates RFC 8628.

Multiple cases were found in aiohttp where excessive or unbounded memory use, or excessive CPU consumption, can be triggered by attacker-controlled requests. An attacker could cause resource exhaustion through specially crafted requests.

GitPython spent 2022-2026 rolling out two reusable guards method-by-method: Git.check_unsafe_protocols(url) (raises UnsafeProtocolError for <transport>:: remote-helper URLs) and Git.check_unsafe_options(...) (raises UnsafeOptionError for denylisted options). The description indicates the rollout did not cover all code paths.

GitPython's config-name validator only neutralizes CR/LF/NUL for the "option" label; it does not reject =, #, ;, [, ], or whitespace in an option name. write_section writes the option name verbatim into the config file, so an option name such as sshCommand = touch <cmd> can inject configuration.

This is a residual of GHSA-g5vv-9gxw-82hx / CVE-2026-87819. The 3.1.60 fix made Actor._from_string regex-free, but parse_actor_and_date still runs _re_actor_epoch on the same author/committer/tagger line one step earlier. That pattern backtracks quadratically when the trailing epo...

In GitPython, Remote.pull() forwards its positional refspec argument directly to the git pull child process while its unsafe-option guard inspects only keyword arguments. An application that passes attacker-influenced data as the refspec (e.g., a user-supplied branch name) may allow injection of unsafe options.

net-ssh's host-certificate verifier (`Net::SSH::HostKeyEntries::CertAuthority#matches_key?`) checks exactly two things when a server presents an OpenSSH certificate (`*[email protected]`) under a `@cert-authority` trusted-CA entry: (1) the cert is self-consistently signed (signature_valid).

In net-ssh, `Service::Forward#initialize` registers server-initiated auth-agent channel handlers unconditionally, so ordinary port forwarding exposes the local SSH agent.

A vulnerability in the Crass library involves unbounded exponentiation when converting CSS scientific notation number values before clamping the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to consume excessive CPU and memory when processing a tiny input.

The faraday-http-cache library stores cached responses in JSON format by default and reads them back using JSON.load, which honors the json_class key and calls json_create on the named class. Response headers are stored verbatim in the cache entry, so a malicious origin server can return a response with a json_class key leading to unsafe deserialization.

Dalli's meta protocol request formatter writes some numeric arguments into memcached commands without converting them to integers. If an application passes an attacker-controlled String to one of these arguments, CRLF sequences in it are sent to memcached as additional commands on the same connection.

@tiptap/core contains two quadratic regular-expression denial-of-service paths in its default Markdown attribute parsers. Pandoc-style block attributes use two unanchored greedy expressions that rescan repeated __QUOTED_0 prefixes. Inline shortcode attributes use another unanchored expression, which can lead to resource exhaustion.