CVE Vulnerability Catalog

A use-after-free vulnerability in the awk_sub() function (editors/awk.c) of BusyBox v1.38.0 allows attackers to cause a Denial of Service (DoS) by supplying a crafted AWK script.

A privilege escalation vulnerability in WWBN AVideo prior to version 29.0 allows any user who can solve a CAPTCHA to self-grant elevated permissions during registration via unguarded API parameters. Attackers can mark accounts as email-verified and obtain upload, streaming, and meeting creation rights.

A memory management vulnerability in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can cause a persistent denial of service (DoS).

A vulnerability in Cilium from version 1.19.0 to 1.19.4 causes standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors to erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom clusterName.

A vulnerability in Cilium allows users with permissions to create or update namespaced HTTPRoutes to mirror HTTP traffic to any Service in any namespace, bypassing the ReferenceGrant authorization mechanism. Gateway API functionality is disabled by default.

In DataEase before version 2.10.23, authenticated users can submit SVG files via POST /de2api/templateManage/save or DataVisualizationServer.decompression. Files are saved without validating extension, MIME type, or content, allowing stored same-origin cross-site scripting when a victim loads the resource.

Argo CD ServerSideDiff in versions 3.2.0 through 3.2.12, 3.3.10, and 3.4.2 fails to properly sanitize Kubernetes Secret data, potentially exposing sensitive values including those in the kubectl.kubernetes.io/last-applied-configuration annotation. This allows sensitive data to appear in the UI or CLI diffs.

CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to version 14.55. Attackers with local access and administrator privileges can cause a denial of service against the client they control.

CVE-2026-33443 is a memory management error in Secure Access servers prior to version 14.55. Attackers with intimate knowledge and full control over the tunnel protocol can create a persistent DoS against the server.

OpenWrt prior to version 25.12.5 has a vulnerability in the cgi-download handler in cgi-io that allows reading root-readable files including /etc/shadow via path traversal using an allowed wildcard prefix followed by ../.

In TDengine prior to version 3.4.1.15, a Data Reader user with admin_user role on a TDengine Cloud DB instance could execute create udf, even though standard users should have read-only permissions for non-database objects and commands like show dnodes and create user were denied.

In TDengine before version 3.4.1.14, the tGetToken() function in the SQL parser mishandles string literals ending with a backslash, causing an out-of-bounds read. An authenticated user can submit a crafted SQL query to crash the server and potentially leak adjacent memory.

In TDengine Enterprise before version 3.4.1.15, an authenticated low-privilege SQL user could run KILL SSMIGRATE <id> against an active shared-storage migration because the MND_OPER_SSMIGRATE_DB privilege check was commented out in mndProcessKillSsMigrateReq.

In Dashy versions 1.9.4 through 3.2.0, the RSS widget does not sanitize RSS item link values before rendering them as href attributes in anchors. This allows an attacker-controlled feed to provide a javascript: URI that executes when clicked in the Dashy origin.

Repomix MCP server before version 1.14.1 allows registering and reading arbitrary local .json, .txt, .md, or .xml files without the file_system_read_file runSecretLint() safety check or Repomix packed-output validation. This enables MCP callers to bypass the local file-read secret-scanning boundary.

A vulnerability in Apache Ivy allows directory traversal outside the configured buildRoot directory by using "../" sequences in module coordinates (organization, name, version) in ivy.xml files. An attacker with access to a packager repository can overwrite arbitrary files outside the target directory.

A server-side request forgery (SSRF) vulnerability was found in the elasticsearch_memory tool of the strands-agents-tools package. Connection parameters (es_url, cloud_id, api_key) were controllable by the LLM, and omitting api_key caused the operator's API key to be sent to any host specified by the LLM.

In FastGPT from version 4.14.17 to 4.15.0-beta5, an authenticated user can save a workflow node referencing another user's private HTTP toolset using a crafted tool ID. The lack of proper authorization checks in the workflow save and execution path allows execution of the victim-owned HTTP tool.

Dell ThinOS 10 versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. An attacker with physical access could exploit this flaw to gain unauthorized access to encrypted data.

In Splunk Enterprise and Splunk Cloud Platform, a vulnerability allows a low-privileged user (without 'admin' or 'power' roles) to view stored credential hashes. This occurs when the user accesses the `/servicesNS/-/-/storage/passwords` REST endpoint via the `|rest` SPL command, which returns the `encr_password` field.