CVE Vulnerability Catalog

In Envoy from version 1.36.0 to 1.36.9, 1.37.5, and 1.38.3, a Use-After-Free (UAF) vulnerability exists in the ext_authz HTTP filter. It occurs when processing per-route authorization overrides concurrently with rapid downstream client disconnects, leading to a segmentation fault and process crash.

The mise tool (versions from 2026.3.15 to 2026.6.4) loads github.credential_command from a local project config before any trust decision, then executes that value with sh -c when resolving a GitHub token. An attacker who can place a .mise.toml in a repository can execute arbitrary shell commands when the victim runs a GitHub-related mise command and no higher-priority GitHub token environment variable is set.

A vulnerability in mise (versions prior to 2026.6.1) allows creating a symlink outside the install directory by manipulating the version string in .tool-versions. The issue occurs in the HTTP backend, which uses the unsanitized version value to build the symlink path.

In Envoy from version 1.34.0 to 1.35.13, 1.36.9, 1.37.5, and 1.38.3, a vulnerability exists in the TcpStatsdSink component where the thread-local flusher buffer can be overflowed by exceptionally long statistic names (e.g., >16 KiB). An attacker can send an HTTP or gRPC request with an extremely long path (:path) recorded by the grpc_stats filter configured with stats_for_all_methods: true, causing a heap write overflow.

In Envoy, when the UDP DNS filter is configured with local or remote resolution for a name of 255 octets, a query with such a name causes abnormal process termination. This is due to an invalid runtime precondition that the name must be strictly less than 255 octets, contradicting RFC 1035.

A vulnerability in Envoy's TLS certificate validation allows an attacker to serve a certificate with a dNSName SAN containing an embedded NUL byte. Due to improper C-string casting, the domain name is truncated at the NUL, bypassing the exact match check and enabling unauthorized upstream routing.

Envoy prior to versions 1.35.11, 1.36.7, 1.37.3, and 1.38.1 has a vulnerability in the OAuth2 filter where encrypt()/decrypt() functions use AES-256-CBC without an authentication tag. An attacker can exploit a padding oracle on the /callback endpoint to recover the plaintext PKCE code_verifier from the encrypted CodeVerifier cookie.

A vulnerability in Envoy's PROXY Protocol v2 header generator allows TLVs to exceed the maximum length of 65535 bytes, causing a mismatch between written bytes and the length field, enabling byte smuggling in upstream requests.

Envoy contains a null pointer dereference vulnerability in the router filter when handling HTTP 303 internal redirects for body-less requests (POST, PUT, DELETE, PATCH). An attacker can send such a request to a properly configured route, causing a crash of the entire Envoy process.

Envoy crashes if an ext_proc server sends a single gRPC message containing multiple, specially crafted ProcessingResponse messages. This occurs when the first response in the batch causes the gRPC stream object to be destroyed, leading to a use-after-free error when Envoy attempts to process subsequent responses in the same gRPC message.

A vulnerability in the envoy.filters.http.grpc_stats filter causes a null pointer dereference crash in Envoy when a Connect protocol request (Content-Type: application/connect+proto or application/connect+json) hits a direct_response route. Affects versions from 1.26.0 through 1.35.13, 1.36.9, 1.37.5, and 1.38.3.

A vulnerability in AutoGPT allows an authenticated user to access the `POST /api/integrations/webhooks/{webhook_id}/ping` endpoint without verifying that the webhook belongs to them. An attacker can confirm webhook existence, leak the OAuth provider type, and in some cases trigger a ping delivery on behalf of another user.

A vulnerability in Podman from version 3.0.0 to 5.7.1 allows, by running a malicious container image where the WORKDIR path contains a symlink, to create a directory or modify ownership on the host filesystem. Ownership modification is less likely as it requires help from an untrusted process to trigger a race condition.

GitHub MCP Server versions 0.22.0 through 1.1.2, when running in HTTP mode with --lockdown-mode enabled, uses a process-global singleton RepoAccessCache initialized with the first authenticated user's GraphQL client. All subsequent requests from different users share this singleton and their lockdown-related GraphQL queries are executed using the first user's credentials.

In Dokku prior to version 0.38.2, the git:auth command creates the $DOKKU_ROOT/.netrc file using bash's touch command, which applies the default umask of 0644. This pre-creation defeats the netrc binary's built-in 0600 permission setting, leaving git credentials readable by any local user who can traverse the dokku home directory.

In LXD versions 4.12 through 6.9, an SSRF vulnerability in the image import functionality allows authenticated users with can_create_images entitlement to interact with internal network infrastructure via the /images endpoint. The LXD daemon fails to validate outbound destination IP addresses, enabling connections to loopback, RFC1918 private ranges, and cloud metadata endpoints.

A flaw in KubeVirt's network annotation generator allows a tenant with kubevirt.io:edit permissions to inject JSON into the v1.multus-cni.io/default-network annotation due to missing validation. When the ExternalNetResourceInjection feature gate is enabled (off by default), Multus can attach the pod to any network in any namespace.

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

In AutoGPT prior to version 0.6.32, there is a DoS vulnerability in the ExtractTextInformationBlock. A malicious user can send 10 KB of content, causing the server to consume 50 GB of memory, leading to resource exhaustion and denial of service.

In AutoGPT before version 0.6.32, there is a DoS vulnerability in the AITextSummarizerBlock. A malicious user can send 10 KB of content, causing the server to consume 50 GB of memory, leading to resource exhaustion and denial of service.