CVE Vulnerability Catalog

Nodemailer resolves an international (IDN / non-ASCII) recipient domain to a different Punycode label than every UTS-46-conformant parser (web browsers, WHATWG URL Standard, Node's url.domainToASCII, Python's idna). Its address normalizer (_normalizeAddress) may lead to incorrect domain resolution, enabling phishing or message misdirection.

A rogue MySQL server (or a man-in-the-middle) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

gorilla/websocket used math/rand (a cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys. Masking keys MUST be unpredictable to prevent frame content injection attacks.

Several vulnerabilities (two rated critical under CVSSv3) have been discovered and fixed in the upstream libheif dependency. They can lead to remote code execution (RCE) on glibc-based Linux under certain conditions.

A vulnerability in the libheif library used by sharp (which Next.js uses for image optimization) can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.

Nodemailer's address parser parses comma-separated addresses in quadratic time (O(n²)) in the number of addresses. A single crafted address string (e.g., To, Cc, Bcc, From, Reply-To) can cause significant slowdown.

A vulnerability in mysql2 (in lib/compressed_protocol.js, line 43) where zlib.inflate is used to decompress packets. When a connection is created with compress: true and the server advertises CLIENT_COMPRESS, each incoming packet is decompressed without limits, potentially leading to excessive memory usage or DoS.

A vulnerability in the Linux kernel has been fixed that could lead to a null-pointer dereference in the jdi_panel_dsi_remove() function. The issue occurred when the jdi pointer was NULL, potentially causing unexpected system behavior.

A vulnerability in the Linux kernel related to the rio_scan_alloc_net() function has been resolved. In case of idtab allocation failure, memory is released using kfree() instead of rio_free_net().

The Node.js ImageResponse implementation from next/og is affected by an upstream vulnerability, leading to remote code execution. Affected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation.

A vulnerability has been identified in the Linux kernel related to the initialization of subdevice before setting controls in the ov5647 module. The issue arises because the v4l2_get_subdevdata function is called before its initialization, which may lead to malfunction.

A vulnerability in the Linux kernel has been fixed that led to a NULL-pointer dereference in the acpi_processor_errata_piix4() function. The issue occurred during the assignment of IDE and ISA devices.

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs include the method and URI in the request line and the URL host that becomes the `Host:` header.

A vulnerability has been identified in the Linux kernel related to resource leaks during early registration failures. A recent commit fixed most cases, but for some reason, it left out the first error path, which still leaks resources.

A vulnerability related to the eDP issue in the drm/amd/display module has been fixed in the Linux kernel, which required adding a function hook check before use.

A vulnerability in the Linux kernel has been resolved that allowed a user-triggerable WARN in the nested_svm_load_cr3() function. The WARN has been removed from the svm_set_nested_state() function on failure of loading, as it can be trivially triggered from userspace by modifying CPUID after load.

Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into objects with a prototype.

Node-tar (npm tar) contains an uncontrolled recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. Calling tar.t(...) or tar.x(...) with a non-empty member-selection list installs a filter that closes over the recursive mapHas.

Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry traces.

The vulnerability in IOMMU stems from improper input validation, allowing a malicious hypervisor to reconfigure IOMMU registers. This results in loss of guest data integrity.