CVE Vulnerability Catalog

In Zephyr OS, a vulnerability in the DNS resolver uses memcmp() to always compare 7 bytes with the ".local" suffix, even when the final hostname label is shorter. This causes an out-of-bounds read past the string terminator, potentially leading to a page fault and denial of service (DoS). The flaw is present only when CONFIG_MDNS_RESOLVER is enabled and exists since v1.10.0.

A security vulnerability has been detected in radareorg radare2 up to version 6.1.6, involving an integer overflow in the r_str_ndup/r_str_append functions in libr/util/str.c. The attack requires local access and the exploit has been publicly disclosed.

A use-after-free vulnerability has been found in radare2 up to version 6.1.6 in the function r_core_seek_arch_bits within libr/core/disasm.c, specifically in the regprofile handler component.

A heap-based buffer overflow vulnerability was discovered in radare2 up to version 6.1.6 in the r_bin_java_inner_classes_attr_calc_size function of shlr/java/class.c, part of the RBinJava Line Number Table Parser. Local manipulation triggers the overflow, and a public exploit exists.

A vulnerability was found in radare2 up to version 6.1.6 in the cmd_anal_opcode function of libr/core/cmd_anal.inc.c within the hexpairs Parser component. Data manipulation leads to an integer overflow. The attack requires local access and the exploit is publicly available.

A vulnerability in Pardus Pen (TUBITAK BILGEM) involves improper null termination, potentially leading to buffer overflow. It affects versions <=4.1.5 before 4.2.1.

A security vulnerability has been detected in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The function add_definition in application/PHP/objects/notes/add_into_dictionary.php is affected by cross-site scripting via the reference argument. The exploit is publicly available and can be used remotely.

A vulnerability was found in langgraph library from langchain-ai up to version 1.2.4 in the _freeze function of _cache.py, where the default_cache_key argument causes use of a weak hash function. The attack can be performed remotely but is difficult to exploit.

A security flaw in exo-explore exo up to version 1.0.71 uses a weak hash function in the _image_cache_key function of the Vision Feature Cache component. The vulnerability allows remote attacks but is difficult to exploit due to high complexity. A public exploit has been released and may be used in attacks.

A flaw in zcaceres markdownify-mcp up to version 1.1.0 causes insufficiently random values in the saveToTempFile function of src/Markdownify.ts. The attack requires local access and is difficult to exploit, but a public exploit is available.

A vulnerability has been discovered in zcaceres markdownify-mcp up to version 1.1.0, allowing symlink following via the assertPathAllowed function in src/Markdownify.ts. The attack can only be executed locally.

A vulnerability was found in HdrHistogram up to version 2.2.2 in the `DoubleHistogram.recordValue` function. It involves an incorrect comparison during range checking, potentially leading to erroneous behavior. The attack requires local access and is publicly known, but its significance is disputed due to security boundary limitations.

A vulnerability was found in HdrHistogram up to version 2.2.2 in the recordValueWithCount method of the AbstractHistogram class. Manipulation of the Count argument leads to a state issue. The attack requires local access and has been publicly disclosed, but its existence is disputed due to lack of security boundary crossing.

A flaw has been found in HdrHistogram up to version 2.2.2, involving uncontrolled memory allocation in the decodeFromByteBuffer function when processing the numberOfSignificantValueDigits argument. The attack requires local access and an exploit has been published, but the vulnerability is disputed due to potential lack of security boundary crossing.

A vulnerability was found in HdrHistogram up to version 2.2.2, involving uncontrolled memory allocation in the decodeFromCompressedByteBuffer function. The attack requires local access and manipulation of the lengthOfCompressedContents argument. The existence of the vulnerability is disputed due to doubts about crossing security boundaries.

A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the admin/view-users.php file via the User argument. The attack can be performed remotely and the exploit is publicly available.

A vulnerability was found in grass up to version 0.13.4 in the functions grass_compiler::selector::extend and grass_compiler::evaluate::visitor, allowing a local denial of service attack. The maintainer states that DoS vulnerabilities are generally acceptable in Sass compilers due to the exponential nature of the @extend algorithm.

A denial of service vulnerability has been found in the grass library up to version 0.13.4 in the grass_compiler::raw_to_parse_error function of the UTF-8 Character Handler component. A local attack can cause denial of service. The maintainer considers DoS vulnerabilities acceptable in Sass compilers.

A vulnerability was found in the Memory Recall Handler component of the AI-fundermentals library versions 2.0 and 3.0, involving the use of a weak hash function in the get_conversation_history function. Remote exploitation is possible but requires a high degree of complexity.

In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a user for a specific SaaS application within one tenant can be incorrectly applied to SaaS applications with the same name in other tenants, leading to unintended cross-tenant consent sharing.