CVE Vulnerability Catalog

The vulnerability causes memory corruption when processing invalid HT40 channel layouts during dynamic channel switching. This flaw may lead to unexpected system behavior.

The vulnerability is caused by using a static initialization vector (IV) for AES-GCM key wrapping. AES-GCM requires a unique IV for each operation to ensure cryptographic security.

The vulnerability causes memory corruption when allocating memory with sizes exceeding the maximum allowed value. This can lead to unpredictable application behavior.

A vulnerability in the metrics-service retention policy management component of Amazon mcp-gateway-registry before version 1.0.13 allows an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that is interpolated into SQL statements in identifier position.

HashiCorp Terraform Enterprise had an issue in its VCS ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This allowed an authenticated user to include files from outside the intended repository content in a module and then download them, potentially exposing sensitive files readable by the ingestion process.

In Devolutions Server 2026.2.9.0, improper enforcement of a mandatory multi-factor authentication (MFA) policy was found. An attacker with valid user credentials can bypass the MFA Required policy and authenticate without completing multi-factor authentication. The issue occurs when DVLS encounters an invalid default MFA value.

In Pillow before version 12.3.0, the GdImageFile._open() method in GdImageFile.py read image dimensions from the GD 2.x header without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded.

In Pillow before version 12.3.0, the bdf_char() function in BdfFontFile.py reads the BBX width and height from a BDF font file and passes attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing decompression bomb protection and allowing excessive memory allocation.

In Pillow before version 12.3.0, FontFile.compile() does not call Image._decompression_bomb_check(), allowing a font to trigger excessive memory allocation during conversion or saving.

In Pillow before version 12.3.0, the _load_bitmaps() function in PcfFontFile.py reads glyph dimensions from the PCF METRICS section and passes them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF font data to cause excessive memory allocation.

Certain HP DeskJet All-in-One printers may be vulnerable to information disclosure, allowing an unauthenticated attacker to access sensitive information through exposed APIs.

In Apache OpenNLP, the libsvm document categorization module (3.x line) is vulnerable to untrusted Java deserialization. The SvmDoccatModel.deserialize(InputStream) method uses java.io.ObjectInputStream without a filter, allowing an attacker to execute arbitrary code via a crafted stream.

A vulnerability in BeyondTrust Remote Support and Privileged Remote Access allows an unauthenticated remote attacker to trigger a denial-of-service (DoS) condition due to insufficient validation of client-supplied input in the network communication subsystem.

A critical pre-authentication vulnerability in the authentication subsystem of BeyondTrust Remote Support and Privileged Remote Access. Improper validation of authentication data may allow a network-positioned attacker to bypass access controls and gain unauthorized access to the appliance, including accounts with elevated privileges. Exploitation requires a specific authentication configuration to be enabled.

In DrawIO for ownCloud prior to version 1.0.2 (corresponding to ownCloud 10 prior to 10.15.3), a stored XSS vulnerability was found. Attackers with access to the DrawIO app can inject malicious code due to improper input neutralization during page generation.

In the pnpm package manager prior to versions 10.34.4 and 11.7.0, a crafted lockfile alias could be placed directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout.

pnpm before versions 10.34.4 and 11.8.0 accepts package names from the configDependencies section of pnpm-lock.yaml and uses them directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can supply a crafted lock file containing a traversal-shaped config dependency name, leading to symlink creation outside the intended directory.

In pnpm prior to versions 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory, allowing arbitrary file deletion via the pnpm patch-remove command.

In ownCloud 10 prior to version 10.15.3, a path traversal vulnerability allows an attacker with administrative privileges to execute arbitrary code. The issue is fixed in version 10.15.3.

In SharePoint for ownCloud prior to version 0.4.1 (corresponding to ownCloud 10 before 10.15.3), an SSRF vulnerability allows an attacker with administrative privileges to execute arbitrary code on the system.