CVE Vulnerability Catalog

The mall-server 0.0.1-SNAPSHOT application contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.

OctoPrint version 1.0.0 has a vulnerability in the getSettings function in src/octoprint/server/ajax/settings.py, in the API Key Handler component. The manipulation causes information disclosure, and the attack can be carried out remotely. The exploit is publicly available, and the issue is fixed in version 1.1.0-rc1.

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection. This issue affects WpEvently: from n/a through 5.7.9.

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue.

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Arm Keil MDK-Middleware versions 8.0.0–8.3.0 may allow DHCPv6 Option-Walk over-reads and unintended data retransmission. The issue affects the library's network stack.

Arm Keil MDK-Middleware version 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX buffer. The issue affects the library's FTP server component.

Arm Keil MDK-Middleware versions 8.0.0–8.3.0 may allow a pre-authentication out-of-bounds read in SNMP processing. The issue affects the library's SNMP component.

Syncplify Server! 6.0.0 before 8.8.0 contains a path traversal vulnerability that allows attackers to place a symbolic link inside a user's home folder to access files outside the virtual filesystem root, because confinement is enforced only against the requested path and not the on-disk destination of the link.

OpenJPEG versions 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. An attacker can exploit this to cause a denial of service.

The vulnerability in Apache Camel's OAuth component stems from a static token cache shared by every resolver instance in the JVM, keyed only on the token endpoint and client ID. Profiles that share an endpoint and client ID but differ in scope or client secret therefore receive each other's tokens, potentially granting broader authority or reaching a service the token was not issued for.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to bound the volume of text extracted from an uploaded PDF. An authenticated user can exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to apply allocation limits to byte-string decode paths in the WebSocket msgpack decoder. An authenticated remote attacker can cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments. Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace, to node-level processes via /proc/<pid>/cmdline, and are frequently captured in audit/event logs.

The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. Due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website.