CVE Vulnerability Catalog

Podman Desktop prior to version 1.26.2 has an unauthenticated HTTP server that allows any network attacker to remotely trigger DoS conditions and extract sensitive information. Missing connection limits and timeouts can exhaust file descriptors and kernel memory, leading to application crash or host freeze. Verbose error responses disclose internal paths and system details.

OpenTelemetry-Go versions 1.36.0 to 1.40.0 process 'baggage' headers in a way that allows an attacker to amplify CPU and memory allocation by sending many header lines, even if each value is within the 8192-byte limit.

A vulnerability has been identified in suvarchal docker-mcp-server up to version 0.1.0, allowing OS command injection via the HTTP interface. The functions stop_container, remove_container, and pull_container in src/index.ts improperly handle input, enabling remote command execution.

A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2 affecting the function GroovyEvaluator.evaluate in the file /openApi/addWorkflowNode of the OpenAPI Endpoint component. Manipulation of the argument nodeParams results in code injection. The attack can be executed remotely. The project was informed of the problem through an issue report but has not responded yet.

FastFeedParser prior to version 0.5.10, when parse() fetches a URL that returns an HTML page containing a <meta http-equiv="refresh"> tag, it recursively calls itself with the redirect URL — with no depth limit, no visited-URL deduplication, and no redirect count cap. An attacker-controlled server that returns an infinite chain of HTML meta-refresh responses causes unbounded recursion, exhausting the Python call stack and crashing the process. This vulnerability can also be chained with the companion SSRF issue to reach internal network targets after bypassing the initial URL check. This vulnerability is fixed in version 0.5.10.

RedwoodSDK from 1.0.0-beta.50 to 1.0.5 allows server functions from 'use server' files to be invoked via GET requests, bypassing intended HTTP method. In cookie-authenticated apps with SameSite=Lax, CSRF attacks can trigger state changes.

WWBN AVideo up to version 26.0 allows an authenticated uploader to bypass SSRF validation via controlled downloadURL values with extensions .mp4, .mp3, .zip, .jpg, .png, .gif, .webm. The server fetches and stores the response as media, enabling SSRF response exfiltration.

In WWBN AVideo up to version 26.0, the file objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local files such as /etc/passwd or application source files and republish those bytes through a normal public GIF media URL.

Vite versions 7.1.0 to before 7.3.2 and 8.0.5 allow bypassing server.fs.deny restrictions. Files like .env or *.crt can be retrieved with HTTP 200 by appending query parameters ?raw, ?import&raw, or ?import&url&inline.

A vulnerability in Vite (a frontend tooling framework for JavaScript) from 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5 allows an attacker who can connect to the Vite dev server's WebSocket without an Origin header to invoke fetchModule via the vite:invoke event and read arbitrary files on the server as a JavaScript string. HTTP access controls are not applied to this WebSocket channel.

OpenObserve is a cloud-native observability platform. In 0.70.3 and earlier, the validate_enrichment_url function in src/handler/http/request/enrichment_table/mod.rs fails to block IPv6 addresses because Rust's url crate returns them with surrounding brackets (e.g. "[::1]" not "::1"). An authenticated attacker can reach internal services blocked from external access. On cloud deployments this enables retrieval of IAM credentials via AWS IMDSv1 (169.254.169.254), GCP metadata, or Azure IMDS. On self-hosted deployments it allows probing internal network services.

Drizzle ORM before versions 0.45.2 and 1.0.0-beta.20 improperly escapes quoted SQL identifiers in its escapeName() function. An attacker can inject SQL by passing controlled input to APIs like sql.identifier() or .as().

In PolarLearn 0-PRERELEASE-15 and earlier, POST /api/v1/auth/sign-in creates a valid session for banned accounts before verifying the password. This session is accepted by authenticated API routes, enabling data access and actions as the banned user.

An out-of-bounds read vulnerability in the mgcore_SH_25_3!aligned_free() function in NI LabVIEW. It could lead to information disclosure or arbitrary code execution. Requires the user to open a specially crafted VI file. Affects LabVIEW 2026 Q1 (26.1.0) and prior.

NI LabVIEW has a memory corruption vulnerability due to an out-of-bounds read in sentry_transaction_context_set_operation(). This can lead to information disclosure or arbitrary code execution. Exploitation requires the user to open a specially crafted VI file.

There is a memory corruption vulnerability due to an out-of-bounds write in ResFileFactory::InitResourceMgr() in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file. This vulnerability affects NI LabVIEW 2026 Q1 (26.1.0) and prior versions.

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVCLASS file in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution.

There is a memory corruption vulnerability due to an out-of-bounds write when loading a corrupted LVLIB file in NI LabVIEW. This vulnerability may result in information disclosure or arbitrary code execution.

In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint. An attacker can exploit this vulnerability without any credentials.

Semtech LR11xx LoRa transceivers implement secure boot with a non-standard hashing algorithm vulnerable to second preimage attacks. An attacker with physical access can generate a malicious firmware image with a hash collision, bypassing secure boot and installing unauthorized firmware.