CVE Vulnerability Catalog

An authorization flaw in GitLab EE allows an authenticated user with minimal permissions to read work item metadata from private projects. Affected versions: 18.9 to 18.11.7, 19.0 to 19.0.4, and 19.1 to 19.1.2.

In GitLab CE/EE versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2, a vulnerability in authorization controls on cross-project reference pages allows an unauthenticated user to determine the existence of a private project.

In etcd prior to versions 3.5.32 and 3.6.13, when configured with --listen-client-http-urls to split HTTP and gRPC client endpoints onto separate listeners, the --client-crl-file Certificate Revocation List is not enforced on the gRPC listener. This allows a client with a revoked certificate to authenticate successfully over gRPC.

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.11, 36.0.12, 45.0.3, and 46.0.1, the wasmtime-wasi component checked directory permissions but not matching FilePerms on source and destination preopens during hard-link creation and renaming. This allowed a WASI guest with read-only source file capability to overwrite host files exposed as FilePerms::READ through wasip1, wasip2, or wasip3 filesystem interfaces.

In NATS Server prior to versions 2.14.3 and 2.12.12, a client could be registered as the configured no_auth_user through a parser path used when the first client operation was not CONNECT, bypassing user-level connection restrictions such as allowed_connection_types or proxy_required that normal authentication would apply.

A vulnerability in NATS Server allows an unauthenticated client to send a WebSocket request for the MQTT protocol even when MQTT is not configured. This leads to access to uninitialized MQTT state and crashes the server process.

A vulnerability in Appium base-driver before version 10.7.0 allows reflected XSS attacks by unsafely reflecting the throwError query parameter, comments POST field, and User-Agent header into HTML without proper escaping. An attacker can exploit these routes to execute arbitrary JavaScript on the server origin.

Snipe-IT before version 8.6.1 has a vulnerability where authorization is missing before generating a temporary URL for images stored in S3. An authenticated user who knows a signature filename can obtain a 5-minute signed S3 URL because the S3 branch returns before the `authorize()` call used by the local-file branch.

AsyncSSH version 2.23.0 contains an incomplete fix for CVE-2026-45309 that blocks /, , and .. before %u substitution in AuthorizedKeysFile but does not block a leading ~ or ${ENV}, allowing later expansion in _expand_val and Path(filename).expanduser() to escape the intended authorized-keys directory. This issue is fixed in version 2.23.1.

OpenCTI GraphQL API exposes a script filter operator in its FilterOperator enum that allows authenticated users with KNOWLEDGE capability to pass unsanitized Elasticsearch Painless scripts into search queries. This can cause CPU resource exhaustion and denial of service for all users.

A vulnerability in the Catapult DCT2000 protocol dissector in Wireshark causes a crash. Versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 are susceptible to a denial of service attack.

The pcapng file parser in Wireshark 4.6.0 to 4.6.6 contains a crash vulnerability. An attacker can cause a denial of service (DoS) by providing a specially crafted pcapng file.

A vulnerability in the FMP/NOTIFY protocol dissector in Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 causes a crash, leading to denial of service.

A vulnerability in the SSH protocol dissector in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 causes a crash, allowing an attacker to perform a denial of service (DoS) attack.

A vulnerability in the Z39.50 protocol dissector in Wireshark versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 causes a crash, allowing an attacker to perform a denial of service (DoS) attack.

A vulnerability in the UMTS FP protocol dissector in Wireshark causes a crash, leading to denial of service. Affected versions are 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16.

A vulnerability in the IEEE 802.11 protocol dissector in Wireshark causes a crash. Affected versions are 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16.

A vulnerability in Wireshark 4.6.0 to 4.6.6 causes a crash in the TLS ECH decryptor, allowing an attacker to trigger a denial of service (DoS) by sending specially crafted network traffic.

A vulnerability in ciscodump versions 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 causes a crash, allowing an attacker to perform a denial of service (DoS) attack.

Multiple infinite loops in protocol dissectors in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allow denial of service attacks.