CVE Vulnerability Catalog

In libde265 prior to version 1.0.19, there is a heap-buffer-overflow read vulnerability. The flaw in `decoder_context::decode_slice_unit_tiles` allows reading 4 bytes past the allocated buffer via malformed PPS data.

In s2n-tls before version 1.7.6, a memory leak occurs in the QUIC transport parameters extension handler. During a TLS 1.3 connection with HelloRetryRequest, the handler is called twice; the second call uses s2n_alloc instead of s2n_realloc, zeroing the pointer and leaking the first allocation.

Missing validation of the outer content_type byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without detection. The AEAD implementation hardcodes the application_data value in additional authenticated data instead of using the actual wire byte, so the outer content_type is not covered by the authentication tag.

Tanium addressed an information disclosure vulnerability in Connect.

Data::DisjointSet::Shared before version 0.02 for Perl creates a world-readable mmap backing file (mode 0644) and opens it without O_EXCL or O_NOFOLLOW. A local attacker can read IPC data or use a symlink to redirect the open.

The Data::RoaringBitmap::Shared library for Perl before version 0.02 creates a world-readable mmap backing file (mode 0666) and opens it without O_EXCL or O_NOFOLLOW. This allows a local attacker to read IPC data and replace the file via a symlink.

Data::Buffer::Shared before version 0.05 for Perl creates a world-readable mmap backing file (mode 0644) and opens it without O_NOFOLLOW. A local attacker can read IPC data or use a symlink to redirect the open.

Vulnerability in Data::RoaringBitmap::Shared for Perl before version 0.02 allows an out-of-bounds read via an unvalidated container offset and cardinality in rb_contains_locked. The rb_validate_header validator only checks the header and region layout, not the bucket contents, enabling a local attacker with write access to the backing file to poison a bucket and dereference a wild pointer.

Improper Access Control (CWE-284) in Kibana allows unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access can perform write operations on watchlist data that should require elevated privileges.

A vulnerability in Elasticsearch allows an authenticated low-privileged user to execute a specially crafted EQL query that causes excessive memory consumption and crashes the Elasticsearch node.

Incorrect Authorization (CWE-863) vulnerability in Elasticsearch. An authenticated user with limited index privileges can exploit insufficient authorization controls in the ingest simulation feature. By targeting indices they are not authorized to access directly, the user can cause those indices' configured ingest pipelines to execute and return their output, potentially disclosing data processed or enriched by those pipelines. Additionally, the same feature can be used to retrieve index mapping metadata for indices the user are not authorized to access directly.

Unintended Proxy or Intermediary ('Confused Deputy') (CWE-441) in Kibana can lead to unauthorized information exposure. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access to be processed using another user's privileges.

Nhost CLI prior to 1.46.0 exposes a hidden config server with dummy authorization directives and permissive CORS. A local process or web page can read project secrets (e.g., JWT keys, Grafana passwords) and modify the .secrets file.

Vulnerability in Klever-Go (Go implementation of the Klever blockchain protocol) before version 1.7.17. Read-only mode was not enforced in contract delete and upgrade paths, allowing contracts called in read-only mode to mutate chain state.

A vulnerability in Kibana allows an authenticated user to send a specially crafted request to Entity Analytics endpoints with an oversized input value, causing excessive resource consumption and making Kibana unavailable.

A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents.

In Rattler before version 0.43.2, the EntryPoint::FromStr function does not properly validate the entry point name, allowing file writes outside the installation prefix. A malicious noarch:python package can place an executable file anywhere, e.g., overwriting an existing entry point.

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is gated only by `require_workspace_member(workspace_id)` (default `min_role="member"`). Any member can rewrite the workspace's `name`, `description`, and the `settings` JSON blob. The settings field is a free-form JSON object — depending on which downstream code reads it, this becomes a configuration-injection primitive for any setting the platform exposes there. PraisonAI Platform version 0.1.4 patches the issue.

High severity DoS vulnerability in Confluence Data Center versions 9.0.1 through 10.2.0. An authenticated attacker can cause temporary or permanent unavailability of resources by disrupting services of a network host.

Vulnerability in PraisonAI Platform (versions prior to 0.1.4) involving Insecure Direct Object Reference (IDOR). The `GET /workspaces/{workspace_id}/issues/{issue_id}/activity` endpoint does not enforce workspace membership, allowing any workspace member to read the full activity log of any issue across the multi-tenant deployment.