CVE Vulnerability Catalog

The iskorotkov/avro library for Go before version 2.33.0 contains a remote denial-of-service (DoS) vulnerability. Avro block decoders do not check the reader's error state in the processing loop, allowing an attacker to send a packet with a huge number of elements, causing an infinite loop and CPU exhaustion.

The Go Avro library (iskorotkov/avro) before version 2.33.0 has multiple vulnerabilities in Avro decoders. An attacker can send attacker-controlled 64-bit values that on 32-bit platforms (GOARCH=386, arm, mips, wasm) bypass bounds checks, select wrong union branches, or cause OCF panic. Additionally, on all platforms there are cumulative-size arithmetic overflows in array/map decoders, math.MinInt negation in block headers, and make([]byte, size) with negative size in OCF blocks – all leading to panic or bypassing allocation limits.

Use-after-free/double-free vulnerability in the NDR parser of RDPEAR in FreeRDP prior to version 3.26.0. A malicious server can reuse a ref-id for multiple pointer fields, causing a double free.

In FreeRDP prior to 3.26.0, a malicious RDP server can trigger a heap-buffer-overflow write in the FreeRDP client by sending crafted RDPGFX PDUs. The bug is in gdi_CacheToSurface: it validates a destination rectangle clamped to UINT16_MAX, but performs the copy using the original cacheEntry->width/height, potentially causing a large out-of-bounds heap write and leading to client crashes or code execution.

In FreeRDP prior to 3.26.0, a malicious RDP client can trigger a heap-buffer-overflow write in the server-side clipboard (cliprdr) channel by sending a CB_CLIP_CAPS PDU with a too-small capabilitySetLength. This can crash the server process (remote DoS) and may be exploitable for code execution.

FastGPT, an AI Agent building platform, prior to version 4.15.0-beta1 contains an SSRF vulnerability. An authenticated attacker can bypass the global isInternalAddress network protection and make arbitrary HTTP GET requests to internal network services by exploiting an incomplete fix in the dataset preview endpoint /api/core/dataset/file/getPreviewChunks when using the externalFile data import type.

In JetBrains TeamCity before version 2026.1, improper permission checks expose build configuration parameters. Users without proper permissions may access sensitive settings.

JetBrains TeamCity before version 2026.1 is vulnerable to remote code execution via Perforce connection settings. An attacker can exploit this to execute arbitrary code on the TeamCity server.

In JetBrains TeamCity before versions 2026.1 and 2025.11.5, unauthenticated server-side request forgery (SSRF) via build status is possible.

JetBrains TeamCity before version 2026.1.1 contains a reflected Cross-Site Scripting (XSS) vulnerability in the keyword filter. An attacker can inject malicious JavaScript code that executes in the victim's browser.

JetBrains YouTrack before version 2026.1.13162 allows stored XSS in project notification templates.

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account.

In JetBrains IntelliJ IDEA before 2026.1.1, command injection was possible via filename completion.

Shopper, a Headless e-commerce Admin Panel, prior to version 2.8.0 contains a vulnerability where multiple Filament actions on order details and shipment tables could be called by an authenticated low-privilege user without the required permission to mutate orders. Actions like cancel, mark paid, mark complete, capture payment, archive, and start processing were callable with the read-only read_orders permission instead of the required edit_orders. capturePayment could trigger actual PSP capture (real funds movement). A user with read access could alter the lifecycle of every order and trigger real-world payment captures.

Vulnerability in SillyTavern before version 1.18.0. The /api/search/searxng endpoint accepts attacker-controlled baseUrl, enabling requests to internal or loopback HTTP services.

SillyTavern before version 1.18.0 uses cookie-session for authentication, storing session data in a signed cookie. Password change endpoints do not invalidate existing sessions, allowing an attacker with a stolen cookie to retain access after a password change.

The Danelec MacGregor Voyage Data Recorder device includes a default username and password, with no enforced password change.

The Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.

Stored XSS vulnerability in certain 1xxx series NVR devices due to insufficient input sanitization. Attackers can inject malicious scripts that are persistently stored and executed in the browsers of administrators or users.

The Frontier X2 device allows unauthenticated BLE read/write access to critical GATT characteristics without pairing or authorization. Attackers within BLE range can take control, and the Frontier X app lacks device authentication, allowing impersonation and injection of fake health telemetry (e.g., heart rate, breathing rate).