CVE Vulnerability Catalog

A flaw in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes stems from insufficient validation of advertised IP addresses in EndpointSlice objects. A compromised spoke cluster can create EndpointSlices with attacker-controlled IPs, causing other clusters' lighthouse DNS to redirect legitimate service traffic to malicious endpoints, enabling Man-in-the-Middle attacks.

A vulnerability in Submariner allows a malicious cluster (spoke) to redirect network traffic from other connected clusters by publishing a specially crafted network endpoint. The system fails to properly validate network subnets, enabling the malicious cluster to declare arbitrary network ranges.

Frappe before versions 15.114.0 and 16.26.0 has a vulnerability in the OAuth2 consent flow that allows an attacker to cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client. This is due to missing POST restriction, missing CSRF token, and lack of client scoping for active OAuth tokens.

Frappe version 16.31.0 and earlier has a type confusion vulnerability in frappe.client.set_value, which checks a dictionary supplied via the fieldname parameter against forbidden fields before parsing it into individual field names. An authenticated caller can exploit this to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.

libgit2 before versions 1.8.6 and 1.9.5 performs a fixed-size strncmp in set_data without verifying that the smart-protocol pkt-line capability buffer contains 14 bytes. A malicious Git server can cause format_str to advance beyond the pkt-line and the following memchr length calculation to underflow, leading to a heap out-of-bounds read that can crash a client during the first refs-advertisement packet.

Shaarli before version 0.16.3 is vulnerable to stored XSS in BookmarkListController.php. The permalink handler concatenates the raw bookmark title into the page title and emits it into the <title> element without HTML escaping. A bookmark title containing </title><script>...</script> can execute a script in the Shaarli origin for any visitor. An attacker can convince an administrator to bookmark a malicious URL, leading to administrator account takeover.

In the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways, authentication credentials are transmitted over an unencrypted channel during communication with a third-party DDNS service. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path.

A vulnerability has been found in Tenda CH22 1.0.0.1 in the function formcreateFileName of the file /goform/formcreateFileName. Manipulation of the argument fileNameMit leads to command injection. The attack can be initiated remotely, and the exploit has been publicly disclosed.

Expat through 2.8.3 contains an out-of-bounds read vulnerability that allows attackers to trigger memory corruption by processing XML with external entity parsers created via XML_ExternalEntityParserCreate. A struct size mismatch between ELEMENT_TYPE members causes storeAtts to read the attIndex member past allocated memory boundaries, resulting in failure to normalize whitespace in non-CDATA attributes or a wild pointer dereference causing a segfault. This vulnerability was introduced by the fix for CVE-2026-66046.

Libevent is an event notification library. From 2.2.0-alpha-dev until 2.2.2-alpha, the libevent WebSocket server in ws.c accumulates fragmented frames in evws->incomplete_frames without enforcing a total message-size limit. An unauthenticated remote client can repeatedly send fragmented WebSocket frames below WS_MAX_RECV_FRAME_SZ with FIN=0, causing the evbuffer to grow without bound until the process or host exhausts memory. This issue is fixed in version 2.2.2-alpha.

Libevent prior to 2.1.13 and 2.2.2-alpha has a heap out-of-bounds write in bufferevent_sock.c when bufferevent_socket_set_conn_address_ copies a kernel-supplied AF_UNIX peer address into bufferevent_private.conn_address. Release builds compiled with NDEBUG disable the EVUTIL_ASSERT length guard, and the evhttp accept path can pass a 110-byte sockaddr from accept() into the 28-byte field. An unauthenticated local peer able to connect to an AF_UNIX listener can overwrite the adjacent dns_request pointer and heap data, causing memory corruption with confidentiality, integrity, and availability impact. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Libevent prior to 2.1.13 and 2.2.2-alpha has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Libevent prior to 2.1.13 and 2.2.2-alpha has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

Libevent prior to 2.1.13 and 2.2.2-alpha can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha.

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the move_plugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled plugin_parent value without rejecting a plugin’s own identifier or a descendant identifier. A staff user with plugin-change permission under CMS_PERMISSION can create a parent_id cycle in the plugin tree. The _get_descendants_cte and _get_ancestors_cte queries in cms/models/pluginmodel.py have no cycle guard, so get_descendants() and later rendering, copy, or delete operations can recurse indefinitely or reach a database recursion limit, corrupting the tree and consuming request workers. This issue is fixed in versions 5.0.8.

Samly from version 0.3.0 has a vulnerability of insufficient verification of data authenticity, allowing an attacker to establish an authenticated session using a SAML response the service provider never requested. Validation does not compare the InResponseTo attribute with the AuthnRequest ID.

In Kata Containers, configurations using genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules, allowing mounting arbitrary container-rootfs paths over sensitive host locations or provisioning arbitrary content.

CodeAstro Apartment Visitor Management System 1.0 is vulnerable to SQL injection in password-recovery.php via the email argument. The attack can be performed remotely, and the exploit is publicly available.

CodeAstro Apartment Visitor Management System 1.0 is vulnerable to SQL injection in /apartment-visitor/forgotpw.php via the secode argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

Monkeytype 26.26.0 and earlier has a vulnerability in the rate-limit key generator that uses client-controlled cf-connecting-ip and x-forwarded-for headers before req.ip. An unauthenticated attacker can rotate these headers to bypass rate limits, allowing repeated requests to endpoints like forgotPasswordEmail and verificationEmail, causing mail bombing, exhausting Firebase/SMTP quotas, and evading brute-force protection.