CVE Vulnerability Catalog

OpENer v2.3 (commit 76b95cf) contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remote attacker to cause a denial of service.

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service.

AWS Amplify API Category before version 3.1.2 has a vulnerability in the query resolvers generated by @aws-amplify/graphql-index-transformer that might allow an authenticated remote user to read records owned by other users of the same application via crafted queries. This issue has been addressed in @aws-amplify/graphql-index-transformer 3.1.2.

pacioli, a least-privilege governance tool for ERPNext, versions 0.9.6 through 0.10.0, has a vulnerability in the pacioli-guard document-layer consent gate that allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether the marker authorizes cancellation. A credential with API Key Scope.require_consent can submit a caller-controlled document under a valid marker and reach Document.cancel() for a different pre-existing document, bypassing the marker's binding, single-use spend, and denial audit. This issue is fixed in version 0.10.0.

yopass before version 14.7.0 uses the attacker-controlled r.Method value directly as the method label for Prometheus metrics. An unauthenticated remote attacker can submit many unique methods and create metric series that are never evicted, leading to unbounded memory growth and potential OOM-kill.

ageLANServer before version 1.15.2 has no request body size limit or cap on the attacker-controlled JSON names array in the POST /game/cloud/getFileURL handler. A remote unauthenticated client can send an oversized request causing excessive memory allocation, crashes or hangs the server.

RIOT from version 2023.07 through 2026.07 ignores a failure returned by _resp_init() in nanocoap_fileserver when coap_build_reply() cannot fit a response header into the response buffer. A remote client can send a CoAP request with a large extended token, causing response initialization to fail and leading to an assertion that terminates the service or task.

RIOT in 2026.07 and earlier, the _receive() function in gnrc_sixlowpan.c can route an undersized packet into SFF fragment handling after only a minimal payload check. A remote attacker can send a malformed 6LoWPAN fragment causing read beyond the packet buffer, potentially disclosing memory and crashing the network stack.

RIOT in 2026.07 and earlier, the nanocoap_sock_get_slice() function accepts a Block2 response when _block_cb() sees the expected block number without verifying that the server-controlled szx and derived offset match the requested block geometry. A malicious CoAP server can return the expected block number with a larger block size, causing offset underflow and read before the payload buffer, potentially crashing the client.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, prior to 3.8.1, has a vulnerability in internal/cookies.ParseCookies that handles boundary ASCII control characters and control-only or empty cookie names differently from several backend cookie parsers. An unauthenticated attacker can craft a Cookie header so Coraza indexes or drops a cookie under a different name or value from the backend application, causing rules targeting REQUEST_COOKIES or REQUEST_COOKIES_NAMES to miss application-visible attacker data. This issue is fixed in version 3.8.1.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in the multipart loop in internal/bodyprocessors/multipart.go that executes defer temp.Close() for every uploaded file part, so each temporary-file descriptor remains open until the complete request returns. An unauthenticated attacker can submit a multipart body containing many minimal file parts and exhaust the process file-descriptor table within the request-body size limit, causing os.CreateTemp failures, MULTIPART_STRICT_ERROR responses, blocked legitimate uploads, and process-wide inability to open files or sockets. This issue is fixed in version 3.8.0.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in ProcessResponse in internal/bodyprocessors/json.go that passes the ignoreJSONRecursionLimit value of -1 to readJSON, while the recursive guard only stops at zero. A network attacker who can cause an application protected by Coraza to return deeply nested JSON can make response-body processing perform quadratic work, consuming one CPU core for seconds per response within the default ResponseBodyLimit. This issue is fixed in version 3.8.0.

OWASP Coraza WAF from 3.0.0 until 3.8.1, readJSON in json.go can stop its bounded flattening walk after reaching SecArgumentsLimit or the byte budget and then call gjson.Valid on the complete raw body. An unauthenticated attacker can submit shallow values followed by an extremely deeply nested JSON tail, causing gjson.Valid to recurse without a depth bound and terminate the hosting process with a fatal stack overflow.

OWASP Coraza WAF, a golang modsecurity compatible web application firewall library, versions 3.0.0 through 3.8.0, has a vulnerability in ProcessURI in internal/corazawaf/transaction.go that handles a url.ParseRequestURI failure by retaining the raw URI but leaving QUERY_STRING, ARGS_GET, ARGS_GET_NAMES, and the GET-derived portion of ARGS empty. An unauthenticated attacker can place control bytes in a URI passed directly by integrations such as coraza-spoa, coraza-proxy-wasm, custom FFI hosts, or WASM hosts, causing Coraza to omit query parameters that the downstream integration may still process and allowing rules targeting those variables to be bypassed. This issue is fixed in version 3.8.0.

In versions prior to 1.1, x64dbg-MCP Server (a native MCP plugin for x64dbg) exposes all MCP debugger tools over HTTP and SSE without authentication while listening on 0.0.0.0 by default. Any unauthenticated network client that can reach the default port (9094 for x64, 9095 for x32) can execute arbitrary x64dbg commands, attach to processes by PID, read and write debuggee memory, and write files to arbitrary paths. This issue is fixed in version 1.1.

MariaDB from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, potentially escalating database privileges.

MariaDB server, a community developed fork of MySQL server, versions 10.6.1 through 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, has a vulnerability in the ACL cache that could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

MariaDB from 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code.

x64dbg-MCP Server before version 1.2 has an integer overflow vulnerability in parseContentLength() and wsRecv(), allowing an unauthenticated network client to trigger a panic and terminate the x64dbg process. The server listens on 0.0.0.0 by default, increasing attack surface. Fixed in version 1.2.

MariaDB Connector/C from 3.4.1 to 3.4.10 has a vulnerability in the SSL authentication-switch logic that fails to reject TLS hostname mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker could obtain the database password.