CVE Vulnerability Catalog

A vulnerability in NVIDIA DCGM Exporter allows an attacker to cause excessive resource consumption by sending unauthenticated profiling requests to the /debug/pprof endpoint. This can lead to denial of service and information disclosure.

A vulnerability in GitHub MCP Server causes a Go panic (nil pointer dereference) when handling a completion/complete request with a missing or empty ref field. Since the crash occurs before authentication, any unauthenticated client can cause a denial of service.

WordPress Coding Standards (WordPressCS) from version 0.14.1 to 3.4.0 contains a vulnerability in the WordPress.WP.EnqueuedResourceParameters sniff. The is_falsy() method executes eval() on the $ver argument, allowing arbitrary code execution during PHPCS scanning. An attacker can supply a malicious argument like 'system'('id'), leading to command execution on the scanning host.

Appium Java Client from version 8.2.1 to 10.1.0 has a vulnerability in the directConnect mechanism. When directConnect(true) is enabled, the client reads directConnectHost, directConnectPort, and directConnectPath from the NEW_SESSION response and rebuilds the server URL, validating only the https protocol. A malicious server can redirect traffic to any destination, enabling session interception and SSRF attacks on internal hosts.

ArkSigner Desktop Client from version v2.2.16.10 through 17062026 has an Uncontrolled Search Path Element vulnerability allowing Search Order Hijacking. An attacker can place a malicious library in the search path, leading to unauthorized code execution.

The MISP Apache HTTP virtual-host configuration contains a malformed HTTP-to-HTTPS redirect missing a trailing slash in the destination URL. An attacker can exploit this to redirect users to a malicious site via a crafted HTTP request.

Anchore Enterprise from version 5.11.0 to 5.27.1 and 6.0.0 has an improper privilege escalation vulnerability in the user management API. An authenticated attacker can issue an API call to modify user permissions, gaining access to additional resources. The system-admin role cannot be granted, but a read-only user can gain write access.

Apache ActiveMQ (versions before 5.19.9 and 6.0.0 before 6.2.8) has a vulnerability in the AMQP NIO component. A remote unauthenticated attacker can send a frame with a specific size, causing NIO threads to die. Rapid repetition can exhaust the NIO thread pool, leading to denial of service.

Universal Software Inc. UKBS (versions through 28072026) has a missing authentication for critical function vulnerability. An attacker can access functions not properly constrained by ACLs. The vendor no longer supports the product.

Pivotick has an uncontrolled-recursion vulnerability when processing graph and node data. Recursive graph traversals and JSON rendering can exhaust the JavaScript call stack with specially crafted data, causing page or browser crashes.

Pivotick fails to sanitize attacker-controlled SVG markup from the style.svgIcon property before inserting it into the document. The vulnerable code assigns SVG markup to innerHTML, allowing execution of event handlers like <image> with onerror. An attacker can execute arbitrary JavaScript in the application context.

In the Joomla extension Joomdle versions prior to 3.1.1, the default configuration allows read access and password reset of CMS accounts. This is an insecure default configuration.

Parts of the DM_OP handling code assume the caller has provided the required number of buffers without checking. This can lead to access to uninitialized stack structures, causing unpredictable behavior.

The EVTCHNOP_expand_array hypercall checks for FIFO event channels being enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.

Accesses to CMOS memory contents are done using an indirect IO port pair. Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes, allowing a guest to change the index after it being checked, causing an out-of-bound read access.

When grant-copy operations are processed, permission checks may be carried out on a page different from the one involved in the copy when the grant is already pinned, leading to inconsistency.

Platform-op operations use a system-wide lock, but the lock acquisition lacks fairness, and with XSM/Flask enabled, the lock is acquired before permission checks. This is the platform-op issue.

Sysctl operations use a system-wide lock, but the lock acquisition lacks fairness, and with XSM/Flask enabled, the lock is acquired before permission checks. This is the sysctl issue.

In openshift/oauth-proxy, the proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity.