CVE Vulnerability Catalog

In Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS, improper certificate validation in the Devolutions Server connection handling allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate.

In Netty prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in the compression codec pipeline is vulnerable to a denial-of-service attack via a malformed bzip2 stream that causes an infinite loop in the event-loop thread. The vulnerability exists in the RLE state machine within `Bzip2BlockDecompressor.read()`.

Netty prior to versions 4.1.136.Final and 4.2.16.Final has a resource exhaustion vulnerability in HttpContentEncoder (superclass of HttpContentCompressor). The acceptEncodingQueue accumulates attacker-controlled data without size limit, and using HTTP/1.1 pipelining can lead to memory or I/O resource exhaustion.

In the traceparser library, the decode() function has an improper input validation vulnerability. An attacker with a corrupted kernel trace event log (.kev) file can execute arbitrary code or cause a crash in processes that use libtraceparser on QNX hosts or targets.

In 7-Zip, a heap-based buffer overflow vulnerability exists in XZ decompression that allows remote code execution. User interaction is required – the victim must visit a malicious page or open a malicious file. Crafted XZ-compressed data can trigger a heap-based buffer overflow.

A SQL injection vulnerability in Coverity Connect SOAP API for versions 2024.6.0 through 2026.3.0. An authenticated attacker can send a crafted payload to achieve full read access to the database and execute unauthorized commands.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's POSIX CPU timers mechanism. The issue arises from a race condition during a non-leader exec() call, potentially leading to access of a freed timer object.

In the Linux kernel, the s390/pkey driver lacked a length check in the PKEY_VERIFYPROTK ioctl. The vulnerability allows user-space to supply a request structure exceeding the buffer size, potentially leading to a buffer overflow.

In the Linux kernel, the s390/pkey driver lacked a length check for the target buffer in the pkey_pckmo handler for key_to_protkey(). If the generated output exceeds the buffer length, the function fails, but without proper validation it could lead to a buffer overflow.

In proot-distro before version 5.1.6, the restore function accepted hardlink entries whose linkname referenced another installed container without verifying the source. This allows copying files between isolated containers via a crafted archive.

In ZITADEL from 2.43.0 through 2.71.19, 3.0.0 through 3.4.11, and 4.0.0 through 4.15.1, the email and phone self-management APIs allowed users to request returned verification codes without required permissions. This allows claiming ownership of other users' email addresses or phone numbers and bypassing email/phone-based security policies.

In proot-distro before version 5.1.5, installation functions extracting tar archives and Docker layers did not validate archive-controlled symlink targets. This allows planting a symlink to a host path and writing files to the host filesystem.

In Quay, a user configured in GLOBAL_READONLY_SUPER_USERS can view robot account tokens for repositories they are not a member of. This allows an attacker with read-only superuser privileges to impersonate any robot account.

In @fastify/rate-limit before version 11.2.0, rate-limit keys are based on the verbatim client IP. An IPv6 client can bypass the limit by rotating addresses or using different representations of the same address. This affects applications using this module to protect endpoints when trustProxy is enabled.

In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles malformed Cache-Control private directives. A response with a private directive set to an empty value can be stored in the shared cache and served to other users, disclosing private data. Additionally, combining an unqualified and qualified private directive causes a TypeError that can crash the process.

An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.

Xlight FTP Server before version 3.9.5 contains a pre-authentication stack buffer overflow vulnerability. An unauthenticated attacker can send malformed SSH packets with GCM cipher negotiation, leading to stack corruption and potentially remote code execution.

An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getdynamicRender() method in GFPDAcroForm.java. A crafted PDF with a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation, leading to local file disclosure or outbound server-side requests.

An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getRichTextStringOrStreamEntryStringRepresentation() method in DictionaryKeysHelper.java. A crafted PDF with a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report.

A vulnerability in Kong Operator (with embedded KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets using only a label selector, without ingress-class or namespace restrictions. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document, halting all ingress changes.