CVE Vulnerability Catalog

In NamelessMC version 2.2.4, ProfilePostReactionContext.php does not enforce blocked/private-profile visibility, and reactions.php allows unauthenticated GET requests. This allows unauthenticated visitors to read reaction details for private posts and low-privileged users to add reactions to private or blocking posts. Fixed in version 2.2.5.

NamelessMC version 2.2.4 processes wall post submissions before verifying profile access permissions. A user with profile.post permission can write to private profiles and inject replies into arbitrary wall posts. Fixed in version 2.2.5.

NamelessMC 2.2.4 fails to enforce topic-level view_other_topics authorization when reading and modifying post reactions. A user who can access the forum but only see their own topics can read and modify reactions on other users' topics. The issue is fixed in version 2.2.5.

React Router versions 7.5.1 through 7.13.1 in Framework Mode with pre-rendering enabled improperly neutralize the HTTP Location header, allowing XSS in static HTML files if the redirect source is untrusted. Not affected in Declarative or Data Mode. Patched in version 7.13.2.

TP-Link Tapo C200 v5 has a stack-based buffer overflow in RTSP authentication handling due to improper validation of Authorization header lengths. A crafted request crashes the RTSP service and triggers a system reboot, causing denial of service.

Devolutions Server 2026.1.19 and earlier have improper access control in the permission validation component. An authenticated user with entry edit privileges can modify asset information without the required permission.

Devolutions Server 2026.1.19 and earlier have improper access control in the PAM account discovery feature, allowing an authenticated user without administrative privileges to delete network discovery scan configurations.

Appsmith's SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

Elixir Mint library before version 1.9.0 is vulnerable to HTTP response smuggling. The Content-Length parser accepts + and - signs, violating RFC 7230. An attacker-controlled HTTP/1 server can desynchronize response framing on shared connections.

OpenTelemetry eBPF Instrumentation from version 0.7.0 to before version 0.9.0 mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment.

OpenTelemetry eBPF Instrumentation prior to version 0.9.0 has a vulnerability in the custom CappedConcurrentHashMap used for Java TLS state tracking, which never removes keys from its insertion-order queue when entries are deleted, leading to heap memory exhaustion in long-running JVMs.

OpenTelemetry eBPF Instrumentation prior to version 0.9.0 has a vulnerability in the per-CPU message-buffer fallback path. It uses a 256-byte backup buffer but preserves the original payload size (up to 8KB). If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry.

OpenTelemetry eBPF Instrumentation (OBI) before version 0.9.0 has a performance issue when replaying BPF probe hits into histogram observations. On busy systems, large run-count deltas cause excessive CPU usage by the metrics exporter.

OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0 exports raw Redis error text as the span status message. Since Redis error replies can contain attacker-controlled or sensitive values, this can lead to exfiltration of tokens, PII, or other confidential data into telemetry backends and injection of untrusted text into downstream analysis systems.

OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0 has a vulnerability in the ELF parser that trusts section offsets and counts from the executable file. A crafted local ELF file can cause the agent to panic while determining the process language.

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.

Klaw, an Apache Kafka topic management tool, has an improper access control vulnerability that discloses password hashes. This affects versions prior to 2.10.4.

Transmission through 4.1.1 has a clickjacking weakness in the WebUI and RPC response paths. An attacker can trick a user into clicking hidden elements, potentially leading to unauthorized actions.

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a. An authenticated attacker can read any file on the device via a crafted request.

In VIVOTEK FD8136 firmware version FD8136-VVTK-0300a, a stack-based buffer overflow exists in motion_privacy.cgi. An authenticated attacker can remotely execute arbitrary code as root by sending an oversized n1 parameter in a POST request to the relevant CGI endpoints.