CVE Vulnerability Catalog

The HCL BigFix SCM Reporting site contains an outdated and unsupported version of the jQuery 1.x library. The lack of security updates for this version may expose the application to publicly known security weaknesses.

Lokalnie serwisowana strona internetowa na urządzeniach Garmin WDU (w wersjach 1.4.6 i 2.5.0) pozwala na ominięcie mechanizmów uwierzytelniania. Strona WDU wykonuje uwierzytelnienie tylko w przeglądarce klienta, a WebSockety używane do komunikacji z serwerem WDU nie egzekwują żadnego uwierzytelnienia.

Lokalnie serwisowana strona internetowa na urządzeniach Garmin WDU (w wersjach 1.4.6 i 2.5.0) jest podatna na atak symlink. Umożliwia to atakującemu przesłanie złośliwego pakietu graficznego zawierającego symlinki, które serwer WWW śledzi podczas serwowania treści.

The Flight framework for PHP prior to version 3.18.1 has a vulnerability where the default error handler Engine::_error() exposes full exception details in the HTTP 500 response, including absolute filesystem paths.

The Flight framework for PHP prior to version 3.18.1 has a vulnerability that allows unconditionally honoring the X-HTTP-Method-Override header and the $_REQUEST['_method'] parameter for any HTTP verbs, including safe ones like GET. This can lead to CSRF escalation and bypassing security measures based on unsafe verbs.

In versions prior to 3.18.1 of the Flight framework, the SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() methods build SQL queries by directly concatenating the $table argument and the keys of the $data array, without proper identifier quoting and validation. This allows attackers to inject arbitrary SQL by crafting malicious array keys.

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, Flight::jsonp() concatenates the ?jsonp= query parameter directly into an application/javascript response body without validating that the value is a legal JavaScript identifier.

An Editor can overwrite a dashboard not owned by them to acquire admin on that specific dashboard. The user must have write access to escalate privilege.

The vulnerability affects the Auth Proxy feature, which defaults to using /32 IPv6 addresses. Addresses specifying a mask explicitly are not affected by this vulnerability.

CVE-2026-8466 in ninenines cowboy has a resource allocation without limits vulnerability, which can lead to denial of service through unbounded buffer accumulation during multipart header parsing.

CVE-2026-43970 is a vulnerability related to improper handling of highly compressed data in the cowlib library, which can lead to remote denial of service attacks via memory exhaustion. It allows unauthenticated users to send specially crafted SPDY frames that can cause significant memory consumption.

A vulnerability in Netty (prior to 4.2.13.Final and 4.1.133.Final) in HttpContentDecompressor. The maxAllocation parameter limiting decompression buffer size is correctly enforced for gzip and deflate encodings but silently ignored for br (Brotli), zstd, and snappy. An attacker can bypass the decompression limit by sending a compressed payload with Content-Encoding: br instead of gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections.

A vulnerability in Netty's HttpClientCodec component causes incorrect pairing of HTTP responses with requests when using pipelining with GET and HEAD requests. When the server returns 103 and 200 responses, the queue pairs the HEAD response with the first 200 response, leading to incorrect data reading and stream offset.

Netty prior to versions 4.2.13.Final and 4.1.133.Final has a vulnerability in Lz4FrameDecoder that allocates a ByteBuf of size decompressedLength, potentially leading to uncontrolled memory allocation. An attacker can exploit a 21-byte header and compressed data to force this allocation.

In Netty before version 4.2.13.Final, the QpackDecoder's decodeHuffmanEncodedLiteral method allocates a byte array based on a length value from the wire without checking if enough readable bytes exist. An attacker can exploit this by sending crafted HTTP/3 header blocks, causing excessive memory allocation and denial of service.

Netty, an asynchronous event-driven network application framework, has a vulnerability in its DNS codec that does not enforce RFC 1035 domain name constraints during encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder.

Netty's HttpProxyHandler constructs HTTP CONNECT requests with header validation disabled, allowing an attacker controlling outbound headers to inject arbitrary HTTP headers. The vulnerability affects versions prior to 4.2.13.Final and 4.1.133.Final.

Netty, an asynchronous network application framework, has an issue in versions from 4.2.0.Final to 4.2.13.Final where the epoll transport fails to detect and close TCP connections that receive a RST after being half-closed. This leads to stale channels that are never cleaned up and, in some code paths, a 100% CPU busy-loop in the event loop thread.

CKAN is an open-source data management system that, prior to versions 2.10.10 and 2.11.5, had a vulnerability allowing SMTP server spoofing. This could enable MITM attacks, exposing credentials and all sent emails.

CVE-2026-33583 vulnerability involves the exposure of the QKEY and internal system keys via an unauthenticated and unencrypted HTTP GET method in the Arqit Symmetric Key Agreement Platform. This issue affects versions of the platform before 26.03.