CVE Vulnerability Catalog

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. An off-by-one error in the PASSERT assertion leads to daemon abort.

The react-native-receive-sharing-intent library contains a path traversal vulnerability that allows a malicious app to write files outside the intended cache directory by supplying a crafted _display_name value with dot-dot path components. Attackers can send an ACTION_SEND intent to the exported share-receiver activity to overwrite arbitrary files in the app's private data directory, including databases, shared preferences, and cached configuration.

A vulnerability in the UTT nv518G router with firmware version nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_445C5C component.

A buffer overflow vulnerability in the UTT nv518G router (firmware version nv518GV3v3.2.7-210919-161313) allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_444C8C component.

A buffer overflow vulnerability in UTT nv518G device (firmware version nv518GV3v3.2.7-210919-161313) allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_487330 component.

Notepad3 up to version 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibrary(L"MSFTEDIT.DLL") with a bare DLL name, allowing a local attacker to place a malicious MSFTEDIT.DLL in the application directory or another preferred DLL search location and achieve arbitrary code execution in the context of the user when the About dialog is opened.

A denial-of-service vulnerability in pdfcpu up to version 0.11.1 is caused by uncontrolled recursion in the PDF parser. Functions ParseObjectContext() and parseArray() in parse.go recursively process nested PDF objects without enforcing a maximum nesting depth, potentially leading to stack overflow.

A vulnerability in Dapr Sentry allows a remote unauthenticated attacker to poison the OIDC discovery document by manipulating the X-Forwarded-Host header. Relying parties performing dynamic discovery may fetch JWKS from an attacker-controlled server, leading to acceptance of forged JWT tokens.

LobeChat before version 2.2.10-canary.18 contains a server-side request forgery (SSRF) vulnerability. An authenticated attacker can direct internal HTTP requests to arbitrary URLs by exploiting the skill import (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the ssrf-safe-fetch wrapper.

Pathway through 0.31.1 (fixed in commit d09722e) allows a remote unauthenticated attacker to cause a denial of service by sending a short glob pattern with many ** tokens to the /v1/retrieve, /v1/inputs, or /v2/answer HTTP endpoints. The recursive matcher without memoization leads to exponential time complexity, consuming CPU for tens of seconds per request.

In Weaviate before version 1.38.0, there is no verification that a principal assigning an RBAC role holds the permissions granted by that role. A user with the delegated assign_and_revoke_users or assign_and_revoke_groups permission can assign the built-in admin role to themselves or others, leading to privilege escalation to full database control.

JuiceFS up to version 1.3.1 contains an authentication bypass vulnerability. An unauthenticated remote attacker can access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. The attacker can retrieve the process command line containing metadata engine connection strings with database credentials, gaining full read/write access to the filesystem metadata.

Cockpit CMS up to version 2.14.0 contains a path traversal and local file inclusion (LFI) vulnerability. Unauthenticated attackers can read arbitrary files or execute PHP code by injecting unvalidated PATH_INFO from REQUEST_URI into filesystem path construction without containment checks.

A buffer overflow vulnerability has been discovered in the UTT nv518G device running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit the gohead/sub_483ba0 component to cause a denial of service (DoS).

The TinyPNG plugin for WordPress (versions up to 3.6.13) contains an arbitrary file deletion vulnerability exploitable by authenticated attackers with author-level access or higher. The issue stems from insufficient file path validation in the delete_converted_image_size function.

Eclipse Wakaama before snapshot/2026-05-26 has an unbounded memory allocation vulnerability in the CoAP Block1 handler in coap/block.c. An unauthenticated remote attacker can send a sequence of Block1 PUT requests with incrementing block numbers, causing repeated reallocation of an accumulation buffer without a maximum size limit, leading to server memory exhaustion and denial of service.

A stored XSS vulnerability was found in the web management interface of Archer C5 v6.8 routers due to insufficient input validation and output encoding. An admin can inject malicious HTML/JS that executes when another admin views the affected page.

Vulnerability in the Erlang/OTP ssl application. An unauthenticated attacker can send a crafted TLS 1.3 ClientHello, crashing the session ticket handler and making TLS 1.3 unusable until the ssl application is restarted.

Craft CMS versions 5.7.0 through 5.9.20 contain a mass-assignment vulnerability in the bulk-duplicate element action. An attacker who can duplicate their own entries can submit an arbitrary id via the newAttributes parameter, leading to overwriting an existing victim entry.

Landray OA contains an unauthenticated HQL injection vulnerability that allows attackers to query Hibernate entities by injecting malicious HQL syntax into the uid parameter of the wechatLoginHelper.do endpoint. Lack of input sanitization in the filter expression passed to the Hibernate findList() method enables extraction of sensitive data like administrator password hashes and, with sufficient database privileges, file-write operations leading to remote code execution.