CVE Vulnerability Catalog

IBM Langflow OSS versions 1.0.0 through 1.10.2 is vulnerable to server-side request forgery (SSRF). This may allow an unauthenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.

IBM Langflow OSS versions 1.0.0 through 1.11.5 suffer from improper cache key isolation in the MCP Tools component. An authenticated attacker can access another user's MCP server context.

A vulnerability was found in FFmpeg 8.0.x in the parse_playlist function of libavformat/hlsproto.c (Duration Parser component). Manipulating the duration/target_duration argument results in denial of service, exploitable remotely.

A vulnerability exists in FFmpeg up to 4.4.6/5.1.8/6.1.4/7.1.3/8.0.1 in the setup_3x3 function of libavfilter/vf_convolution.c (Convolution Filter component). It leads to an out-of-bounds read, and the exploit has been publicly disclosed.

A flaw exists in cosmicstack-labs mercury-agent up to 1.1.13 in the githubRequest function of src/utils/github.ts (GitHub API Handler component). Manipulating the path argument causes server-side request forgery, and the exploit has been publicly disclosed.

A vulnerability exists in cosmicstack-labs mercury-agent up to 1.1.13 in the checkShellCommand function of src/capabilities/permissions.ts (Shell Command Execution component). The flaw is an incorrect behavior order: validate before canonicalize, and the exploit is publicly available.

In MCP Atlassian from 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request uses the raw hostname and resolves it again without IP pinning. This enables DNS-rebinding attacks and unauthenticated requests to cloud metadata or internal services.

In ASTEVAL prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Interpreter.eval(), while run() and eval() catch only Exception. When an attacker-controlled expression raises one of these classes, the exception bypasses the interpreter's safety handlers and propagates into the calling application, causing denial of service.

In Tract prior to 0.21.16, 0.22.2, and 0.23.1, tract-nnef uses unchecked usize multiplication in nnef/src/tensors.rs read_tensor for attacker-controlled tensor dimensions. Loading a crafted NNEF archive can cause an out-of-bounds heap read and disclose adjacent data, or terminate the process with a segmentation fault.

In PocketSphinx prior to 5.1.1, the trie language-model loaders in src/lm/ngram_model_trie.c do not adequately validate boundary conditions in ARPA, DMP, and binary format headers, and the acoustic-model loaders in src/mdef.c and src/util/bio.c use sscanf with unbounded string fields. Loading an invalid or malicious model can cause stack or heap buffer overflows and memory corruption.

In Skipper prior to 0.26.22, the Handler in dataclients/kubernetes/admission/admission.go passes request bodies to the Kubernetes admission endpoint at :9443/admission directly to io.ReadAll(r.Body) without a size limit. An attacker with in-cluster network access and a valid Kubernetes client certificate can send a very large body, causing unbounded memory allocation and an out-of-memory termination of the Skipper process.

Skipper before version 0.27.13 exposes cluster-wide control-plane data via /routes, /routes/{zone}, /swarm/redis/shards, and /swarm/valkey/shards without application-layer authentication. The handlers only restrict HTTP methods and do not authenticate callers. A compromised pod can bypass namespace-scoped RBAC and read sensitive data across namespaces.

Envoy Gateway before versions 1.7.4 and 1.8.1 has a vulnerability in the internal imagefetcher that fetches Wasm images based on tenant-controlled URLs. During extraction, an untrusted tar header size can cause a massive memory allocation, leading to an unrecoverable Go runtime out-of-memory failure and reconciliation crash-loops.

IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote attacker to obtain sensitive information due to improper validation of the WebSocket origin.

IBM i versions 7.6, 7.5, 7.4, and 7.3 may allow a remote unauthenticated attacker to gain access to sensitive information through session IP binding bypass in Navigator for i.

IBM Langflow OSS versions 1.0.0 through 1.10.2 may allow a remote authenticated attacker to change the password of an account due to improper authentication.

IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) may allow a remote authenticated attacker to cause a denial of service due to uncontrolled resource consumption.

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 may allow a remote attacker to obtain sensitive information due to improper request validation.

IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server) may allow a remote authenticated attacker to cause a denial of service due to a null pointer dereference.

IBM WebSphere Application Server versions 9.0 and 8.5 are affected by an authentication bypass vulnerability when using XD or Intelligent-Management features.