CVE Vulnerability Catalog

An integer overflow in Skia in Google Chrome before version 156.0.8078.73 may allow a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

A buffer overflow in V8 in Google Chrome before version 156.0.8078.73 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

In a2aproject a2a-js up to 1.1.0, the ResultManager.applyStatusUpdate function in src/server/result_manager.ts is vulnerable to a race condition. The attack can be launched remotely, and the fix is included in version 1.2.0 (commit 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25).

ast_loggrabber executes a Python script from the world-writable /tmp directory. An attacker already authorized to open a shell session on the Asterisk server may place a malicious script there and gain elevated privileges or execute code when an administrator runs ast_loggrabber with elevated privileges.

An out-of-bounds write in the Codec2 decoder caused by a floor/ceil sample-count mismatch leads to a heap buffer overflow. An authenticated attacker can exploit it by sending crafted Codec2 audio packets within an established call.

In the russh Rust SSH library from 0.60.0 until 0.65.0, channel-open parsing accepts a peer-declared maximum_packet_size of zero and passes it into ChannelTx::poll_writable. Asynchronous write paths remain pending forever, allowing an authenticated client to strand server writes and a malicious server to strand client writes.

In russh prior to 0.65.0, the client Session::process_packet path accepts repeated packets encoded with russh's private msg::EXT_INFO = 7 before authentication. The handle_ext_info function appends every parsed extension name to received_extensions without clearing, deduplicating, or bounding the vector, causing progressive client memory exhaustion.

In the Crass Ruby CSS parser prior to 1.0.8, a closing parenthesis after an escaped backslash is incorrectly treated as escaped while consuming the remnants of a bad URL. Crass keeps declarations, style rules, or at-rules inside a bad URL token even though a browser treats them as live CSS.

In OpenTelemetry Python prior to 1.45.0, JaegerPropagator.extract() in opentelemetry-propagator-jaeger processes inbound uberctx-* baggage values without entry, per-entry byte, or total-byte limits. When an untrusted carrier supplies numerous or oversized values, the service performs unnecessary CPU work and short-lived heap allocations, contributing to denial of service.

MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 2.19.0 until 3.17.0, mlflow.crewai.autolog() records CrewAI Agent objects without consistently sanitizing nested credential-bearing values. mlflow/crewai/autolog.py::_get_agent_attributes() converts the Agent llm field to a string that includes the provider API key, while mlflow/crewai/autolog.py::_construct_full_inputs() expands the Agent object into mlflow.spanInputs. Applications can therefore send plaintext provider credentials to the MLflow trace backend or a configured OTLP destination, where trace readers can obtain them. This issue is fixed in version 3.17.0.

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented sensitiveHeaders option is checked with value instanceof Array, so an array created in another JavaScript realm is replaced with an empty list even though Array.isArray recognizes it. When a request then follows an attacker-controlled cross-origin redirect, a custom credential header named in that discarded list can be forwarded to the redirect destination. This issue is fixed in version 1.16.2.

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing an unresolved $ref value to fetch an HTTP, HTTPS, or file URL from the client's network and filesystem context. A server can trigger blind requests or local-file reads and can stall every session in the process because resolution runs synchronously on the event loop without a timeout. This issue is fixed in versions 1.30.0 and 2.2.0.

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client client paths enable follow_redirects and follow redirects to a different origin, forwarding caller-supplied custom credential headers and, for 307 or 308 responses, the request body. An attacker who can influence a trusted endpoint's redirect destination can receive that material. This issue is fixed in versions 1.30.0 and 2.2.0.

In the Model Context Protocol Python SDK from 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token issued for another service when the authorization server serves multiple resources and the TokenVerifier does not independently validate the aud audience. This resource-confusion flaw lets a token holder authenticate to the wrong MCP server and exercise that token's resulting access. The issue is fixed in versions 1.30.0 and 2.2.0.

MISP Guard contained an incomplete validation check for required taxonomy tags. It only verified that at least one tag of that taxonomy matched the configured allowed list, without verifying that every tag of the required taxonomy present on the event or attribute was in the allowed list. As a result, an event or attribute could simultaneously carry an allowed tag (e.g., tlp:clear) and a non-allowed tag (e.g., tlp:red or tlp:amber) and still pass the guard's policy check.

Tanium addressed a SQL injection vulnerability in Provision.

Grafana's RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.

In reduxjs redux-devtools 5.0.0, the evalAction function of the Remotedev Server component allows code injection through manipulation of the action argument. The attack is only possible with local access, and the exploit has been made public.

Prior to version 0.27.0, HomeBox validates generic notifier URLs with ValidateNotifierURL, but shoutrrr sends requests through http.DefaultClient.Do without a CheckRedirect policy that revalidates each Location target. An authenticated collection member can configure a permitted notifier host that redirects to loopback, link-local, cloud metadata, or another blocked destination.

From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member can send mouse and keyboard events through the legacy control channel while controls are locked.