CVE Vulnerability Catalog

Description not available in the provided data.

In FRRouting (FRR) up to version 7.3.1, when using the split-config feature, the init script creates an empty config file with world-readable default permissions, potentially leading to information leakage via frr.in and frrcommon.sh.in tools.

Axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get(), axios.delete(), axios.head(), and axios.options().

Path traversal vulnerability in serve-static on Windows via encoded backslash (%5C) in the request path. On Windows hosts, an encoded backslash (%5C) decodes to \, which the Windows path treats as a directory separator.

Vulnerability in the iscsi-initiator-utils package involves out-of-bounds write and information disclosure via unvalidated IPv6 payload length. Crafted ICMPv6 Echo requests can cause the iscsiuio daemon to trust an inflated ipv6_plen larger than the actual received payload.

Node-tar (npm tar) contains an uncontrolled recursion stack-exhaustion DoS in the internal mapHas helper used by filesFilter. Calling tar.t(...) or tar.x(...) with a non-empty member-selection list installs a filter that closes over the recursive mapHas.

The iscsi-initiator-utils package version 6.2.1.11-0.git4b3e853.el10 has a stack buffer overflow vulnerability in idbm_recinfo_config. A malicious iSCSI target can inject an extra configuration line into a persisted node record via a crafted SendTargets TargetName, later causing a stack buffer overflow.

On Red Hat Enterprise Linux systems with xdg-user-dirs before 0.15.5, the system umask policy is not honored when creating XDG user directories because Xsession sources xdg-user-dirs.sh before setting umask. This may lead to incorrect directory permissions.

Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. A privileged user combined with a high complexity attack may enable this via local access.

Several vulnerabilities have been discovered and fixed in the upstream libvips dependency, two rated as high severity using CVSSv4. Versions of sharp prior to 0.35.0 processing untrusted input are affected.

Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into objects with a prototype.

A vulnerability in the os package of the Go standard library allows improper access to the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") opens the parent directory, bypassing access restrictions.

A vulnerability in Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The multiprocessing library with the forkserver start method permits pickle deserialization from any user on the same local network of the machine.

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).

A vulnerability in the assembly implementation of an internal cryptographic function on the ppc64le architecture leaks a few bits of secret scalars due to the use of a variable-time instruction. Based on how this function is used, the leakage is not sufficient to recover the private key.

A vulnerability in Go's HTTP/2 implementation allows a malicious client to rapidly create and reset requests, causing excessive server resource consumption. Although the number of concurrent streams is limited by MaxConcurrentStreams, resetting requests enables the attacker to continuously send new requests.

The email module in Python through 3.11.3 incorrectly parses email addresses containing special characters. The wrong portion of an RFC2822 header is identified as the value of the addr-spec.

A vulnerability in cross-origin redirect handling causes Proxy-Authorization and Proxy-Authenticate headers to persist, potentially leaking sensitive authentication data.

No description is available for CVE-2026-6502. The nature of the vulnerability cannot be determined.

The KeyTrap vulnerability in the DNSSEC protocol allows a remote attacker to cause a Denial of Service (DoS) by sending DNSSEC responses containing many DNSKEY and RRSIG records. This leads to excessive CPU consumption on the DNS server, potentially causing overload.