CVE Vulnerability Catalog

MCP Ruby SDK before version 0.23.0 in StreamableHTTPTransport reads the entire JSON-RPC POST body without size limits, allowing an unauthenticated remote attacker to exhaust process memory.

MCP Ruby SDK before version 0.23.0 does not bind a session ID to its owner, allowing an attacker with a stolen session ID to send tools/call requests in the victim's session.

DriveLock has a directory traversal vulnerability in its web service on port 6067, allowing an unauthenticated remote attacker to disclose sensitive information due to lack of path validation.

DriveLock has an SQL injection vulnerability in its web service on port 4568, allowing an authenticated remote attacker to escalate privileges due to lack of input validation in SQL queries.

DriveLock has a directory traversal vulnerability in its web service on port 4568, allowing an unauthenticated remote attacker to disclose sensitive information due to lack of path validation.

Vulnerability in ATEN Unizon RpcProvider allows a remote attacker to cause a denial-of-service (DoS) without authentication. Lack of authentication before accessing RpcProvider functionality enables system overload.

Vulnerability in GStreamer qtdemux allows a remote attacker to execute arbitrary code via a stack-based buffer overflow when parsing UncompressedFrameConfigBox structures. User interaction with the library is required.

Vulnerability in pgvector before version 0.8.6 allows a database user to write data out-of-bounds when building an IVFFlat index, potentially leading to arbitrary code execution. Only 32-bit systems are affected.

Vulnerability in GitLab CE/EE (versions 11.8 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an unauthenticated user to cause a denial-of-service (DoS) due to insufficient resource throttling when processing merge request discussions.

Vulnerability in G DATA Total Security Backup Service allows a local attacker to escalate privileges via a symbolic link following attack. The attacker can delete a file and gain SYSTEM privileges.

Vulnerability in GitLab CE/EE (versions 18.0 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an authenticated user to modify another user's CI/CD configuration due to improper validation of attributes when processing pipeline schedules.

Vulnerability in Heimdall Data Database Proxy in the generateFileContent function allows an authenticated remote attacker to execute arbitrary code via CRLF injection. The attacker can gain root privileges.

Vulnerability in Flyto2 Core before version 2.26.7 allows an attacker to perform SSRF requests to internal or metadata endpoints via HTTP modules that fetch attacker-controlled URLs without validation.

Vulnerability in Flyto2 Core before version 2.26.6 allows environment variable expansion ${env.VAR} without an allowlist, bypassing the default denylist policy and exfiltrating secrets through allowed modules.

Vulnerability in Flyto2 Core before version 2.26.6 allows the llm.chat module to read provider keys (e.g., OPENAI_API_KEY) from the environment and send them in the Authorization header to an attacker-controlled server, leading to key leakage.

In Flyto2 Core prior to version 2.26.7, HTTP modules validate only the initial URL and then follow redirects without per-hop Location revalidation. This allows a public URL to redirect into internal address space and return the internal response body.

In V through version 0.5.2, an SSRF bypass vulnerability exists that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. A crafted URL with a backslash in the authority section can bypass validation and connect to an internal host.

Netty prior to versions 4.1.136.Final and 4.2.16.Final is vulnerable to a forced WebSocket upgrade via the lax V07/V08 handshaker. An attacker can send Sec-WebSocket-Version: 7 while omitting Connection: Upgrade and Upgrade: websocket headers, completing a protocol switch unrecognized by proxies, enabling HTTP request smuggling and protocol-confusion attacks.

In consul-mcp-server versions 0.1.0 through 0.1.3, the Consul backend address was not restricted, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect Consul API traffic to an attacker-controlled endpoint and potentially exfiltrate the Consul token.

The TL-WR940N v6 router has a vulnerability in its RTSP connection tracking module that leads to a stack-based buffer overflow. When a LAN client connects to a malicious RTSP server, a crafted RTSP message can trigger improper memory handling in the kernel module.