CVE Vulnerability Catalog

Dräger Infinity M300 patient monitors with software version VG2.x and earlier contain a network-based denial of service vulnerability. Attackers with network access can repeatedly trigger device reboots until the device enters a fail state requiring manual restart.

Dräger Perseus A500 versions 2.00 to 2.02 have an improper input handling vulnerability via the Medibus interface. Sending crafted data can overload the processor, triggering a warm restart, dropping ventilation pressure to ambient level and interrupting ventilation for several seconds.

Dräger Infinity M300 patient monitors with software version VG2.3.1 and earlier contain a network-based denial of service vulnerability that allows network-adjacent attackers to repeatedly trigger device reboots by sending malicious requests over the Infinity Network.

CZ.NIC BIRD Internet Routing Daemon up to version 2.19.0 has a stack-based buffer overflow in the BGP AS_PATH mask matching implementation. The as_path_match() function uses a fixed-size array, and parse_path() does not limit expanded ASNs, potentially causing a daemon crash. The vendor does not plan a fix.

OpenClaude prior to version 0.5.1 contains a logic flaw in the MCP authentication flow that allows an attacker to completely bypass the state parameter validation and force the temporary local HTTP server to shut down, without knowing the state value at all.

Dell ThinOS 10 versions prior to 2602_10.0765 contain an improper access control vulnerability. An unauthenticated attacker with physical access could exploit this to expose information.

NamelessMC, website software for Minecraft servers, in version 2.2.4 does not enforce blocked/private-profile visibility when adding reactions to profile posts. The file `core/classes/Misc/ProfilePostReactionContext.php` only verifies the post exists. Authenticated low-privileged users can add reactions to private or blocking profile posts. Version 2.2.5 contains a patch.

In NamelessMC version 2.2.4, ProfilePostReactionContext.php does not enforce blocked/private-profile visibility, and reactions.php allows unauthenticated GET requests. This allows unauthenticated visitors to read reaction details for private posts and low-privileged users to add reactions to private or blocking posts. Fixed in version 2.2.5.

NamelessMC version 2.2.4 processes wall post submissions before verifying profile access permissions. A user with profile.post permission can write to private profiles and inject replies into arbitrary wall posts. Fixed in version 2.2.5.

NamelessMC 2.2.4 fails to enforce topic-level view_other_topics authorization when reading and modifying post reactions. A user who can access the forum but only see their own topics can read and modify reactions on other users' topics. The issue is fixed in version 2.2.5.

React Router versions 7.5.1 through 7.13.1 in Framework Mode with pre-rendering enabled improperly neutralize the HTTP Location header, allowing XSS in static HTML files if the redirect source is untrusted. Not affected in Declarative or Data Mode. Patched in version 7.13.2.

TP-Link Tapo C200 v5 has a stack-based buffer overflow in RTSP authentication handling due to improper validation of Authorization header lengths. A crafted request crashes the RTSP service and triggers a system reboot, causing denial of service.

Devolutions Server 2026.1.19 and earlier have improper access control in the permission validation component. An authenticated user with entry edit privileges can modify asset information without the required permission.

Devolutions Server 2026.1.19 and earlier have improper access control in the PAM account discovery feature, allowing an authenticated user without administrative privileges to delete network discovery scan configurations.

Appsmith's SQL query editor's autocomplete functionality fails to sanitize database object names before rendering them in innerHTML, allowing an authenticated Developer to inject persistent XSS by malicious table or column names triggering arbitrary code execution in the sessions of other workspace members when they interact with the same datasource.

Elixir Mint library before version 1.9.0 is vulnerable to HTTP response smuggling. The Content-Length parser accepts + and - signs, violating RFC 7230. An attacker-controlled HTTP/1 server can desynchronize response framing on shared connections.

OpenTelemetry eBPF Instrumentation from version 0.7.0 to before version 0.9.0 mishandles writev buffers by reading only the first iovec entry but using the total iov_iter.count as the copy length. When log injection is enabled, a crafted multi-segment writev call can make OBI read and overwrite memory beyond the first segment.

OpenTelemetry eBPF Instrumentation prior to version 0.9.0 has a vulnerability in the custom CappedConcurrentHashMap used for Java TLS state tracking, which never removes keys from its insertion-order queue when entries are deleted, leading to heap memory exhaustion in long-running JVMs.

OpenTelemetry eBPF Instrumentation prior to version 0.9.0 has a vulnerability in the per-CPU message-buffer fallback path. It uses a 256-byte backup buffer but preserves the original payload size (up to 8KB). If a CPU mismatch occurs, OBI can read beyond the fallback buffer and leak adjacent memory into telemetry.

OpenTelemetry eBPF Instrumentation (OBI) before version 0.9.0 has a performance issue when replaying BPF probe hits into histogram observations. On busy systems, large run-count deltas cause excessive CPU usage by the metrics exporter.