CVE Vulnerability Catalog

In Open5GS up to version 2.7.7, a denial of service vulnerability exists in the ogs_pool_id_calloc function in /lib/sbi/nghttp2-server.c. The attack can be launched remotely and the exploit has been made public.

A vulnerability in Open5GS up to version 2.7.7 in the function ogs_sbi_xact_add in the library /lib/core/ogs-timer.c (ue-authentications Endpoint) allows denial of service (DoS) via manipulation. The attack can be performed remotely, and the exploit is publicly available.

Open5GS up to version 2.7.7 has a vulnerability in the library lib/sbi/nnrf-handler.c (Shared NF-profile Parser component), leading to denial of service.

In Open5GS up to version 2.7.7, the handle_scp_info function in lib/sbi/nnrf-handler.c of the Shared NF-profile Parser component causes an out-of-bounds write. Remote exploitation is possible and the exploit is public.

In the lib/sbi/nnrf-handler.c library in Open5GS up to version 2.7.7, there is a DoS vulnerability through manipulation of the Shared NF-profile Parser. The attack can be launched remotely, and the exploit is publicly available.

The SocketCAN implementation validates the length of a user-provided buffer containing a socketcan_frame object using only a NET_ASSERT statement in zcan_sendto_ctx() before dereferencing it in socketcan_to_can_frame(). In production builds where assertions are disabled, a userspace application that controls the length passed to a sendto syscall can supply an incomplete or truncated frame, causing socketcan_to_can_frame() to dereference fields beyond the end of the buffer. This results in an out-of-bounds read that can cause denial-of-service crashes or, because the parsed frame contents are transmitted on the network, leak adjacent memory.

Exim 4.88 before 4.99.4 in some proxy configurations mishandles short payloads, disclosing uninitialized stack memory values to a client.

A race condition in the shared Extreme Platform ONE IAM Gateway API-key authentication path could, under high-concurrency traffic, intermittently allow requests authenticated with one tenant's API key to receive response data for another tenant. The issue was observed through ExtremeCloud IQ/XIQ API endpoints and validated against both XIQ/XAPI and Extreme Platform ONE /Common Services API paths; XIQ-native tokens and standard OAuth/Bearer JWT authentication were not affected.

FreeScout prior to 1.8.221 allows a non-admin user to permanently delete an internal note from any conversation, even after access to the mailbox has been revoked, due to missing mailbox membership check in ThreadPolicy::delete. Fixed in 1.8.221.

FreeScout prior to 1.8.221 has a missing mailbox membership check in ThreadPolicy::edit, allowing a user with PERM_EDIT_CONVERSATIONS to rewrite thread content after being removed from the mailbox. Fixed in 1.8.221.

cpp-httplib prior to 0.43.4 has a vulnerability related to negative chunk-size in chunked Transfer-Encoding. The ChunkedDecoder::read_payload function parses the chunk-size field using std::strtoul(), which accepts a leading minus sign, causing unsigned wrap-around. The library only rejects -1, but other negative values like -2 pass validation, leading to unbounded memory allocation and process crash.

FreeScout prior to version 1.8.219 has a vulnerability in the password reset endpoint that returns visually distinct responses depending on whether the submitted email address belongs to an existing user account. This allows unauthenticated attackers to enumerate valid helpdesk agent email addresses.

The brace-expansion library versions 5.0.0 to before 5.0.6 apply the max option too late, causing excessive memory (~505 MB) and CPU (~800 ms) usage when expanding large numeric ranges. Fixed in version 5.0.6.

NanoMQ MQTT Broker before version 0.24.14 has a type confusion vulnerability during dialer close. This leads to incorrect object interpretation and may cause hang or crash.

FastGPT before version 4.15.0-beta1 has a vulnerability in the JavaScript sandbox worker at projects/code-sandbox/src/pool/worker.ts:356. The regex blocking dynamic import() does not account for block comments between 'import' and '('. An attacker can use the payload import/**/("child_process") to bypass the regex and execute arbitrary commands as uid=100(sandbox) inside the sandbox container.

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image.

TP-Link TL-SG108PE v5 switch has a stored cross-site scripting vulnerability in the web management interface due to improper sanitization of the SYSNAM configuration parameter during configuration file import. An attacker with administrator access can inject malicious script that executes in the administrator's browser when viewing the interface.

In JetBrains YouTrack before 2026.1.13570, improper access control allowed enumeration of restricted issues and articles on Planning Canvas.

In JetBrains YouTrack before 2026.1.13570, improper access control allowed low-privileged users to modify service accounts.

In JetBrains PyCharm before version 2025.3.4, a stored XSS vulnerability was found in Jupyter notebook Markdown cells. An attacker can inject malicious JavaScript that executes in the browser of any user viewing the notebook.