CVE Vulnerability Catalog

The Confluent Kafka Python client's HashiCorp Vault KMS integration has improper TLS certificate validation, which could allow a remote attacker to obtain sensitive information.

Lektor 3.3.14 and 3.4.0b15 contains a CSRF vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions such as writing files, deleting pages, wiping build output, and triggering publication, by sending requests from malicious web pages.

Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback.

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps in its WebSocket handler. A remote attacker can open multiple WebSocket connections and send messages in a loop, causing a Go runtime data race that crashes the process, requiring operator intervention.

Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding. This allows a poisoned discovery response to replace all endpoint values with attacker-controlled values rather than endpoint URLs that share the origin of the configured server metadata URL.

Tapo C120 v1 and C200 v5 cameras have a NULL pointer dereference vulnerability in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate the presence of a password field for certain parameter combinations, allowing a malformed request from the local network to crash the HTTPS service.

AWS security-agent-mcp-server before version 0.2.0 has an argument injection vulnerability in the diff scan operation, which could allow an attacker to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value.

Tapo C120 v1 and C200 v5 cameras do not enforce authentication for HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network.

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information.

djehuty prior to version 26.3.2 contains a SPARQL injection vulnerability in search/listing queries through three parameters. An unauthenticated attacker can execute read queries, allowing cross-graph data exfiltration (e.g., private data) and denial-of-service via expensive or malformed queries.

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. An attacker who can have a Smile document parsed may embed a property name of unbounded length, causing memory exhaustion and denial of service. This issue also affects the CBOR parser and is tracked in advisory GHSA-3v8f-v6vx-fmrm.

The CBOR parser in FasterXML jackson-dataformats-binary does not enforce the maxNameLength limit for JSON object property names, allowing processing of names of unbounded length. An attacker can submit a CBOR document with an extremely long property name, leading to memory exhaustion and denial of service. The vulnerability is specific to binary formats and does not affect the standard JSON parser in jackson-core.

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.

A flaw was found in rubygem-hammer_cli. A command injection vulnerability exists in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system() method. By passing a single interpolated string to system(), the application invokes a system shell (/bin/sh) that interprets shell metacharacters (e.g., ;, |, &).

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the normally applied privilege check, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. The issue affects all versions of VxWorks 7 prior to 26.09 and has been fixed in 26.09.

KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration, allowing inherited properties to be treated as explicitly supplied values. When Object.prototype is already polluted or an attacker controls the options object's prototype, attacker-controlled mathematical expressions can use an inherited trust value to enable trusted rendering and produce links capable of user-interaction cross-site scripting or loading attacker-selected external resources in a consuming application that inserts unsanitized KaTeX output into a page. KaTeX does not itself create the prototype pollution, and rendering an expression alone does not execute script. This issue is fixed in version 0.18.2.

Capacitor versions from 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1 have a vulnerability in the Android and iOS WebView navigation guard: it validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. Fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.

A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.