CVE Vulnerability Catalog

A command injection vulnerability in QNAP operating systems. A remote attacker with an administrator account can execute arbitrary commands.

NULL pointer dereference vulnerability in QNAP operating systems. A remote attacker with an administrator account can exploit this to cause a denial-of-service (DoS) attack.

A CSRF vulnerability in Notification Center allows remote attackers to exploit it to gain privileges or hijack user identities. The vulnerability has been fixed in Notification Center version 1.10.0.3291 and later.

Heap buffer overflow in the protocomm component of the ESP-IDF IoT framework. Occurs during Security Scheme 2 (SRP6a) session setup, where a client-supplied username length is copied into a smaller buffer, corrupting the heap.

In the ESP-IDF Espressif IoT Development Framework, a NULL-pointer dereference exists in the esp_http_server component during WebSocket subprotocol negotiation. The missing NULL check on the tokenization result of the Sec-WebSocket-Protocol header can crash the server before authentication.

In Espressif IoT Development Framework (ESP-IDF) versions 5.5.4 and 6.0, several ESP-TEE secure-service wrappers fail to validate all caller-supplied pointer arguments, allowing the REE to read TEE memory. This issue has been fixed in versions 5.5.5 and 6.0.1.

Multiple stack-based buffer overflows in the SimpleBLE library for Bluetooth Low Energy. Vulnerabilities exist in the Protocol::simpleble_write function and during processing of manufacturer and service data in BLE advertisements.

BuddyPress 14.4.0 contains a regular expression injection vulnerability in the activity mention resolver. When username compatibility mode is enabled, attackers can manipulate a REGEXP database clause by crafting mention names containing regex metacharacters. Metacharacters in @mentions pass through esc_sql unescaped and are inserted into an unprepared REGEXP query, enabling username inference and DoS through catastrophic backtracking.

BuddyPress 14.4.0 contains an insecure direct object reference vulnerability in the messages REST API, allowing authenticated attackers to access arbitrary private message threads by supplying a user_id parameter in the request. Attackers can pass another user's identifier to the get_item_permissions_check method, which validates the supplied user_id instead of the logged-in user and is reused by update and delete handlers, to read, reply to, or delete any user's private messages.

A remote, unauthenticated denial-of-service vulnerability in Nimiq prior to version 1.5.0 allows any state-sync peer to crash any node performing state synchronization via MerkleRadixTrie::put_chunk.

A vulnerability in the Rust implementation of Nimiq before version 1.4.0 causes the DhtResults accumulator in handle_dht_get() to be initialized only after the first DHT record passes verification. If the first record fails (from a malicious node), all subsequent valid records are discarded.

OpenEMR before version 8.0.0.1 contains a stored XSS vulnerability in the prescription CSS/HTML multi-print feature. A patient portal user can inject malicious JavaScript into demographic fields, which executes in the clinician's session, allowing session hijacking and actions as the clinician.

LMDeploy is a toolkit for compressing, deploying, and serving large language models. In versions 0.12.3 and prior, hardcoded "trust_remote_code=True" enables HF supply-chain RCE without user opt-in. Version 0.13.0 patches the issue.

SimpleSAMLphp-casserver before version 7.0.3 has a path traversal vulnerability in FileSystemTicketStore. An attacker can use ../ sequences in the ticket identifier to read and unserialize arbitrary files outside the ticket directory, and in CAS 1.0 also delete them.

LMDeploy versions up to 0.12.3 have hardcoded "trust_remote_code=True" in multiple HuggingFace model-loading call sites, allowing arbitrary code execution. No public patches are available at the time of publication.

Cloud Hypervisor versions 21.0 through before 51.2 allow a guest to trigger a use-after-free by submitting two virtio-block descriptor chains with the same head_index while asynchronous block I/O is enabled. Patched in versions 51.2 and 52.0.

In Pipecat, from version 0.0.90 to before version 1.2.0, a path traversal vulnerability exists in the development runner. This allows an attacker to access files that the pipecat process has permissions for through a single unauthenticated HTTP request.

A vulnerability in the JsonPulsarHeaderMapper component in Spring for Apache Pulsar causes type header matching against trusted packages to use a prefix check, meaning trusting any package implicitly trusts all its subpackages. Additionally, an empty trusted-packages configuration falls back to trusting all packages instead of a safe default allow-list.

JsonKafkaHeaderMapper and the deprecated DefaultKafkaHeaderMapper matched type headers against trusted packages using a prefix check, meaning trusting any package implicitly trusts all its subpackages. Combined with Jackson's default bean deserialization, a producer can supply crafted header values that cause the consumer to deserialize arbitrary JDK types. Affected versions: Spring for Apache Kafka 4.0.0-4.0.5, 3.3.0-3.3.15, 3.2.0-3.2.13, 2.9.0-2.9.13, 2.8.0-2.8.11.

Vulnerability in Spring Data REST involving SpEL expression injection through map-typed properties when processing JSON Patch requests. The JSON Pointer path segment used as the map key is embedded into a SpEL expression without sanitization. Affects versions 3.7.0-3.7.19, 4.3.0-4.3.16, 4.4.0-4.4.14, 4.5.0-4.5.11, 5.0.0-5.0.5.