CVE Vulnerability Catalog

SeaweedFS is a distributed storage system for files and blobs. From 4.0.388 until 4.41, the SFTP Helm chart embedded one unencrypted Ed25519 private host key in k8s/charts/seaweedfs/templates/sftp/sftp-secret.yaml as stringData.seaweedfs_sftp_ssh_private_key. A standalone deployment presented that public key when sftp.enabled and sftp.enableAuth were true, sftp.existingConfigSecret was not supplied, the legacy sftp.sshPrivateKey path remained selected, a valid config-ssh Secret allowed startup, and hostKeysFolder did not provide a later Ed25519 signer. An attacker able to redirect or intercept client traffic could impersonate that SFTP endpoint to clients that trusted the published host identity, exposing password credentials or data sent to the rogue endpoint. Default all-in-one and non-authenticated standalone paths did not load the key. This issue is fixed in version 4.41.

An infinite loop vulnerability in the erl_tar module (Erlang OTP stdlib) and in copies of that code shipped by hex_core, Hex, and rebar3. An attacker can supply a crafted tar archive with a GNU sparse member whose sparse map ends before its real size, causing the extracting process to loop forever and keep one scheduler busy. The {max_size, N} option only prevents this when N is below the member's real size; extraction with the memory option is not affected.

Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) has an improper validation of consistency within input. A malicious TLS 1.3 server can cause a denial of service of the ssl application on the client node by sending a NewSessionTicket message with invalid extensions.

An authentication rate-limit bypass in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to make repeated password guesses through GraphQL without incrementing Zimbra’s source-IP failure counter.

An LDAP filter injection vulnerability in Zimbra Collaboration Suite 10.1.0 through 10.1.21 allows unauthenticated attackers to alter external LDAP search filters. On domains using search-filter authentication and lazy provisioning, this creates a password oracle for external directory users. Authenticated S/MIME lookups can also return certificates and identity data for unintended directory entries.

F´ (F Prime) prior to 4.3.0 has a vulnerability in Svc::FileUplink where the destination path from a StartPacket is copied and opened for writing without canonicalization or confinement to an upload directory. This allows creating or overwriting files at attacker-selected locations.

F´ (F Prime) prior to 4.2.0 has a vulnerability in Svc::Ccsds::SpacePacketDeframer where the handler treats the minimum packet-length condition as FW_ASSERT rather than rejecting the buffer. When a telecommand frame leaves six or fewer bytes, the assertion aborts or resets the process, causing denial of service.

A flaw was found in DPDK lib/vhost where a guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.

A flaw was found in DPDK lib/vhost where a double-offset bug in vhost log mapping calculation can lead to incorrect memory access.

A flaw was found in DPDK lib/vhost where a TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.

In Talos Linux prior to 1.12.9 and 1.13.3, talosctl includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. Sharing such a bundle with an unintended party can disclose private registry authentication parameters. The issue is fixed in versions 1.12.9 and 1.13.3.

KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create TriggerAuthentication and ScaledObject resources can set hashiCorpVault.address to a tenant-controlled endpoint and select Kubernetes authentication without an explicit credential. KEDA then uses the operator pod's projected ServiceAccount token and sends it to that endpoint as a Vault login credential; the JWT-shape filter from the prior CVE-2025-68476 remediation accepts the operator token because its subject is a Kubernetes ServiceAccount, allowing the attacker to obtain the operator's cluster-wide permissions, including broad Secret reads and workload or admission-related operations.

The CC1200 sub-GHz IEEE 802.15.4 driver reads the PHY packet length from the first byte of the radio's RX FIFO in get_packet_length() and validates it in verify_rxfifo_validity(), which only enforces a lower bound (pkt_len < 3) and never bounds large values. Because the radio is configured for variable packet length with PKT_LEN = 0xFF, the over-the-air length byte (0-255) reaches net_pkt_rx_alloc_with_buffer() and the SPI burst read unclamped. An unauthenticated attacker within radio range can transmit a frame with a length byte above the IEEE 802.15.4 maximum of 127, causing a write past the end of a network buffer fragment.

The NXP KW41Z IEEE 802.15.4 driver (kw41z_rx() in drivers/ieee802154/ieee802154_kw41z.c) computed the payload size as pkt_len = len - KW41Z_FCS_LENGTH in a uint8_t. Because the frame length comes from the unauthenticated RX_FRAME_LENGTH field of the ZLL IRQSTS register and only zero was rejected, a reported length of one underflowed to pkt_len == 255. This caused 255 bytes to be written into a 128-byte net_buf data block, overrunning it by up to 127 bytes into adjacent network-buffer-pool memory and reading past the PKT_BUFFER_RX register array.

The MQTT 5 parser in RabbitMQ accepts the Request-Problem-Information property on PUBLISH packets even though it is valid only for CONNECT. An authenticated publisher with topic write permission can cause the broker to store and route that inapplicable property to a matching subscriber, leading to a function_clause exception that closes the victim's MQTT or Web MQTT connection. The issue is fixed in versions 3.13.19, 4.0.24, 4.1.15, 4.2.10, and 4.3.5.

The MCP Python SDK (mcp on PyPI) from 1.8.0 until 1.30.0 and 2.2.0 does not reliably discard session entries in stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager. A client that can reach the endpoint can send ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected.

A Stack-based Buffer Overflow vulnerability in the srxpfe of Juniper Networks Junos OS and Junos OS Evolved on the SRX Series. An L2-adjacent attacker can execute arbitrary code as root via high-availability fabric traffic.

A Stack-based Buffer Overflow vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a configured external BGP neighbor to execute arbitrary commands with root privileges via BMP route monitoring.