CVE Vulnerability Catalog

DBHub, a database MCP server, in versions prior to 0.22.5 exposes an unauthenticated HTTP MCP endpoint when started in HTTP transport mode. Its protection based on comparing Origin and Host headers does not prevent DNS rebinding, allowing a malicious website to invoke MCP tools from the victim's browser. Depending on configuration, this can lead to reading, enumerating, and potentially writing database contents.

The http4s-scala-xml library in versions prior to 0.24.1 and 1.0.0-M39 uses a SAXParserFactory without security configuration to decode XML message bodies. With default JDK settings, the parser resolves DOCTYPE declarations, external entities, and external DTDs. Applications parsing untrusted XML are vulnerable to XXE, SSRF, and resource exhaustion attacks.

Decepticon, an autonomous hacking agent for red teams, in versions prior to 1.1.17 wraps web crawl results into LLM messages without neutralizing ChatML special-token literals. Under the BYOK model, most model providers do not filter these literals, so an attacker can plant them on a target page to forge an operator turn and bypass agent guardrails. This results in arbitrary command execution inside the Kali Linux sandbox.

Prior to version 8.0.0, the x/bonds module of the ixo Blockchain moved funds from an address resolved from a DID verification method without verifying that the resolved address belonged to the transaction signer. An attacker could register victims' addresses as verification methods on their own DID and move victims' balances into an attacker-controlled bond, later withdrawing and bridging the proceeds off-chain. This was exploited on ixo mainnet (ixo-5) on 2026-06-20 and fixed in v8.0.0.

In the Linux kernel, in the RDMA rtrs-srv subsystem, process_read and process_write did not validate that usr_len is less than or equal to off, which could lead to an integer underflow. A malicious RDMA client could send usr_len greater than off, causing data_len to wrap to a huge size_t value and leading to out-of-bounds memory access. Validation of usr_len <= off was added before calling rtrs_srv_get_ops_ids().

QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag().

In Termix from 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1.

In Dokploy prior to 0.29.13, the patch.readRepoDirectories tRPC procedure passes the user-controlled repoPath value from patch.ts into a shell command in patch-repo.ts without safe argument quoting. An authenticated organization member with service:read permission can inject shell metacharacters into repoPath and execute arbitrary commands through child_process.exec as root in the Dokploy container. Because the standard deployment mounts /var/run/docker.sock, container-root command execution can be used to control Docker and compromise the host and its managed applications. This issue is fixed in version 0.29.13.

A vulnerability was found in the Linux kernel's svcrdma module (NFS/RDMA server). A remote peer can send a Write or Reply chunk with a segcount field of zero, which passes validation in xdr_check_write_chunk() and causes a degenerate chunk (ch_segcount == 0) to be linked onto the rc_write_pcl or rc_reply_pcl lists. An earlier patch made pcl_for_each_segment() safe for segcount 0, but the issue remains relevant as defense in depth.

A vulnerability in the Linux kernel's SUNRPC module involves not zeroing the rpc_gss_wire_cred structure at the entry of svcauth_gss_decode_credbody(). Since the structure is reused across requests, early decode failures leave partially stale data, potentially leading to dangling pointers or incorrect lengths. The fix zeroes the structure at entry.

minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field.

In OpenStack Zaqar before 22.0.2, the WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature header, an unauthenticated remote attacker who knows a target project's UUID may bypass both Keystone authentication and pre-signed URL verification, resulting in the ability to read, enumerate, create, and delete that project's queues, messages, claims, and subscriptions. By additionally claiming an administrative role, the attacker may also perform administrative operations, such as managing pools and flavors in admin_mode deployments. Only deployments using the WSGI transport with an authentication strategy configured are affected; the websocket transport is not affected.

In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate path or channel.

An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpack_tree_parse_children() can overflow size_t and produce an undersized allocation.

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.

An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getServerUrlHash function.

mcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote MCP server's WWW-Authenticate header.

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro dispatcher's lack of authorization model combined with the path resolver's failure to confine absolute paths to manipulate the template engine and compromise the confidentiality, integrity, and availability of the host.

HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to achieve remote code execution by embedding malicious template syntax in a filename. Attackers can craft a filename containing a closing template quoting sequence followed by an exec macro, which bypasses the authorization check in the dispatcher to execute arbitrary commands on the underlying host system.

Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an arbitrary Cloudflare service token. Applications using the Cloudflare Zero Trust authentication strategy are affected. verify_token/2 in lib/nimble_zta/cloudflare.ex matches the result of JOSE.JWT.verify/2 against {_, token, _s}, which discards the boolean verification result and returns the decoded token after a failed signature check. The attacker sends a forged JWT in the cf-access-jwt-assertion header, carrying the expected iss claim and the seven service token claims. verify_iss/2 reads the iss claim from the forged token, so it rejects nothing, and the service token path then returns those claims as the authenticated identity. This issue affects nimble_zta: from 0.1.2 before 0.1.3.