CVE Vulnerability Catalog

In NATS Server before versions 2.14.3 and 2.12.12, an authenticated MQTT client could subscribe to the internal $MQTT.deliver.pubrel subject family, bypassing configured subscribe permissions and exposing MQTT QoS2 protocol metadata for sessions in the account.

In NATS Server versions prior to 2.14.3 and 2.12.12, a vulnerability was found in MQTT message handling. The delivery paths for retained messages and QoS1+ durable replay did not recheck the original topic before sending the MQTT PUBLISH to the subscriber, potentially bypassing configured subscribe deny rules.

In the Fiber web framework for Go prior to version 3.4.0, the helmet middleware incorrectly checks the protocol using c.Protocol() instead of c.Scheme(), causing the Strict-Transport-Security header to never be set even when HSTSMaxAge is configured. This issue is fixed in version 3.4.0.

In the Fiber web framework for Go, prior to versions 3.3.0 and 2.52.14, the BalancerForward proxy helper in middleware/proxy/proxy.go uses Header.Add() instead of Header.Set() when injecting the X-Real-IP header. This allows an attacker to supply a first X-Real-IP value that gets forwarded to upstream servers for logging, rate limiting, and access control.

A vulnerability in the ONNX library (versions 1.9.0 through 1.22.0) allows a null pointer dereference in the Upsample_6_7::adapt_upsample_6_7() function when processing a malicious model with an Upsample node having zero inputs. This leads to an unrecoverable denial of service (DoS).

In the Fiber web framework for Go prior to version 3.3.0, the default Authorizer function in the BasicAuth middleware uses short-circuit evaluation that skips password hash comparison for non-existent usernames. This allows reliable remote username enumeration through response timing differences.

A vulnerability in the Code 27 Companion Hub allows an attacker with physical access to completely bypass kiosk restrictions by performing a factory reset. The protection mechanism fails to prevent this operation, enabling unauthorized system access.

A vulnerability in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging (ADB) and Android Debug Bridge components.

A ReDoS vulnerability was found in the `guardrails-detectors` component of Red Hat OpenShift AI. A remote attacker can send crafted regular expressions to the public detection API, causing catastrophic backtracking and 100% CPU usage by a worker process.

The consul-template library before version 0.42.1 is vulnerable to a path redirection issue in the writeToFile template helper, which may allow template output to be written outside the intended directory or to overwrite an existing file. This vulnerability is fixed in consul-template 0.42.1.

In the pypdf library prior to version 6.14.0, a vulnerability allows an attacker to craft a PDF with declared image size values much larger than the actual data, causing excessive memory usage during image parsing. This can be exploited for a denial-of-service (DoS) attack by exhausting memory resources.

A vulnerability in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset concat/changegroup merge path.

A NULL pointer dereference in the SQLite Session Extension in SQLite 3.53.1 and trunk builds before e807d4e3798efd53 allows an attacker to cause a denial of service by supplying a malformed changeset blob. The issue occurs when sqlite3changeset_apply_v3() processes a corrupt changeset and calls sqlite3_value_type() with a NULL pointer.

A vulnerability in HashiCorp memberlist before version 0.6.0 allows an attacker with network access to the gossip port to exhaust memory on a receiving node, causing process termination. The issue is in push/pull state handling.

In the Mistune Python Markdown parsing library, a vulnerability was found in the toc plugin and TableOfContents directive. They generate heading IDs as predictable toc_N values without slugifying the heading text, allowing an attacker to inject their own id="toc_N" and collide with generated anchors.

Mistune, a Python Markdown parser, prior to version 3.3.0 has a vulnerability due to insufficient filtering of dangerous URI schemes in href and src attributes. The safe_url filter only blocks javascript:, vbscript:, file:, and data: schemes, allowing legacy or chained schemes such as feed:, view-source:, jar:, livescript:, mocha:, ms-its:, mk:, and res: to reach rendered attributes, potentially enabling script execution in affected user agents.

A vulnerability in the Mistune Python Markdown parser before version 3.3.0 allows unbounded recursion via two Markdown files that include each other. This triggers a RecursionError and crashes the rendering process.

In the Mistune Python library, a vulnerability exists due to improper escaping of the :class: option of the Admonition directive before inserting it into the HTML class attribute. This allows attribute injection and XSS attacks even when HTMLRenderer escape mode is enabled. The issue is fixed in version 3.2.1.

Mistune is a Python Markdown parser. Prior to version 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read().

In the Mistune Python library, a vulnerability exists where HTMLRenderer.safe_url() does not block percent-encoded javascript URIs. This allows an attacker to bypass URL protections in Markdown links or images and execute script in rendered HTML.