CVE Vulnerability Catalog

Vulnerability in OpenSSL related to RSASVE, where a failed RSA encryption may return success, leaving an uninitialized buffer. An attacker can exploit this to leak sensitive data from previous process operations.

Vulnerability in OpenSSL when processing a crafted CMS EnvelopedData message with KeyTransportRecipientInfo. Missing check for the optional parameters field in RSA-OAEP leads to a NULL pointer dereference and crash.

Vulnerability in OpenSSL when processing a crafted CMS EnvelopedData message with KeyAgreeRecipientInfo. Missing check for the optional parameters field in KeyEncryptionAlgorithmIdentifier leads to a NULL pointer dereference and crash.

Vulnerability in OpenSSL when processing a delta CRL with a Delta CRL Indicator extension. Missing check for the CRL Number extension leads to a NULL pointer dereference, potentially causing an application crash.

In an uncommon client configuration using DANE TLSA-based server authentication, combined with unusual server TLSA records, a use-after-free and/or double-free may occur on the client side. The vulnerability only affects clients that support TLSA records with both PKIX-TA(0)/PKIX-EE(1) and DANE-TA(2) certificate usages. SMTP clients compliant with RFC7672 are not vulnerable.

Out-of-bounds read in OpenSSL when using AES-CFB128 on systems with AVX-512 and VAES. May cause application crash (DoS) under specific conditions.

mise manages dev tools like node, python, cmake, and terraform. From 2026.2.18 through 2026.4.5, mise loads trust-control settings from a local project .mise.toml before the trust check runs. An attacker who can place a malicious .mise.toml in a repository can make that same file appear trusted and then reach dangerous directives such as [env] _.source, templates, hooks, or tasks.

Podman Desktop prior to version 1.26.2 has an unauthenticated HTTP server that allows any network attacker to remotely trigger DoS conditions and extract sensitive information. Missing connection limits and timeouts can exhaust file descriptors and kernel memory, leading to application crash or host freeze. Verbose error responses disclose internal paths and system details.

OpenTelemetry-Go versions 1.36.0 to 1.40.0 process 'baggage' headers in a way that allows an attacker to amplify CPU and memory allocation by sending many header lines, even if each value is within the 8192-byte limit.

A vulnerability has been identified in suvarchal docker-mcp-server up to version 0.1.0, allowing OS command injection via the HTTP interface. The functions stop_container, remove_container, and pull_container in src/index.ts improperly handle input, enabling remote command execution.

A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2 affecting the function GroovyEvaluator.evaluate in the file /openApi/addWorkflowNode of the OpenAPI Endpoint component. Manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem through an issue report but has not responded yet.

FastFeedParser prior to version 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv="refresh"> tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in version 0.5.10.

RedwoodSDK from 1.0.0-beta.50 to 1.0.5 allows server functions from 'use server' files to be invoked via GET requests, bypassing intended HTTP method. In cookie-authenticated apps with SameSite=Lax, CSRF attacks can trigger state changes.

WWBN AVideo up to version 26.0 allows an authenticated uploader to bypass SSRF validation via controlled downloadURL values with extensions .mp4, .mp3, .zip, .jpg, .png, .gif, .webm. The server fetches and stores the response as media, enabling SSRF response exfiltration.

In WWBN AVideo up to version 26.0, the file objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local files such as /etc/passwd or application source files and republish those bytes through a normal public GIF media URL.

Vite versions 7.1.0 to before 7.3.2 and 8.0.5 allow bypassing server.fs.deny restrictions. Files like .env or *.crt can be retrieved with HTTP 200 by appending query parameters ?raw, ?import&raw, or ?import&url&inline.

A vulnerability in Vite (a frontend tooling framework for JavaScript) from 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5 allows an attacker who can connect to the Vite dev server's WebSocket without an Origin header to invoke fetchModule via the vite:invoke event and read arbitrary files on the server as a JavaScript string. HTTP access controls are not applied to this WebSocket channel.

OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.

Drizzle ORM before versions 0.45.2 and 1.0.0-beta.20 improperly escapes quoted SQL identifiers in its escapeName() function. An attacker can inject SQL by passing controlled input to APIs like sql.identifier() or .as().

In PolarLearn 0-PRERELEASE-15 and earlier, POST /api/v1/auth/sign-in creates a valid session for banned accounts before verifying the password. This session is accepted by authenticated API routes, enabling data access and actions as the banned user.