CVE Vulnerability Catalog

OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0 exports raw Redis error text as the span status message. Since Redis error replies can contain attacker-controlled or sensitive values, this can lead to exfiltration of tokens, PII, or other confidential data into telemetry backends and injection of untrusted text into downstream analysis systems.

OpenTelemetry eBPF Instrumentation (OBI) prior to version 0.9.0 has a vulnerability in the ELF parser that trusts section offsets and counts from the executable file. A crafted local ELF file can cause the agent to panic while determining the process language.

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.

Klaw, an Apache Kafka topic management tool, has an improper access control vulnerability that discloses password hashes. This affects versions prior to 2.10.4.

Transmission through 4.1.1 has a clickjacking weakness in the WebUI and RPC response paths. An attacker can trick a user into clicking hidden elements, potentially leading to unauthorized actions.

A path traversal vulnerability in the /admin/downloadMedias.cgi endpoint of VIVOTEK INC FD8136-VVTK firmware 0300a. An authenticated attacker can read any file on the device via a crafted request.

In VIVOTEK FD8136 firmware version FD8136-VVTK-0300a, a stack-based buffer overflow exists in motion_privacy.cgi. An authenticated attacker can remotely execute arbitrary code as root by sending an oversized n1 parameter in a POST request to the relevant CGI endpoints.

NamelessMC, website software for Minecraft servers, in versions 2.2.4 and prior, does not validate the state parameter server-side during OAuth callback. This allows an attacker to capture a valid OAuth callback URL and swap the victim's session to the attacker-linked account (OAuth login CSRF / session swapping).

Missing authorization in the Elementor Website Builder plugin for WordPress (versions up to 4.1.0) allows exploiting incorrectly configured access control security levels.

Path traversal vulnerability in Gleam's dependency management (versions 0.18.0-rc1 through 1.17.0) allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys are used without validation to construct paths, allowing ../ sequences to escape the intended directory.

A symlink following vulnerability in Gleam's Hex package export allows files outside the project root to be embedded in the generated package tarball. File collection helpers use follow_links(true) when walking publishable directories, and paths are added to the archive without verifying that the resolved target remains within the project root.

In RUGGEDCOM RST2428P (6GK6242-6PA00) before version V4.0, the application stores sensitive information in the browser cache when an authenticated user modifies specific configurations. This allows an authenticated attacker to access sensitive data stored in the browser.

A stack-based buffer overflow in export_language.cgi on VIVOTEK FD8136 firmware FD8136-VVTK-0300a allows authenticated remote attackers to execute arbitrary code as root via a crafted POST request with a controlled Content-Length value.

Path traversal vulnerability in Gleam's custom documentation pages handling (versions 1.16.0 through 1.17.0) allows arbitrary file read and write outside the intended documentation output directory. The documentation.pages[].path and .source fields are used without sufficient validation.

A Reflected XSS vulnerability was found in NamelessMC 2.2.4 in the id parameter of the `/index.php?route=/queries/user/` endpoint. The application reflects user input without proper sanitization, allowing an attacker to inject malicious JavaScript code.

The Progress Planner plugin for WordPress up to version 1.9.0 contains a stored XSS vulnerability due to improper input neutralization during page generation.

Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM from n/a through 1.2.2.

Dräger Infinity Delta, Delta XL, and Kappa patient monitors disclose sensitive information. An unauthenticated network attacker can access log files over a network connection, retrieving device internals, location information, and wired network configuration.

The D.Launcher 2 component of the Slovak eID client ecosystem contains an Improper URL Handler Processing vulnerability. Custom URL handlers can be exploited to initiate full NTLM authentication or SMB connection to attacker infrastructure and to conduct SSRF attacks. User interaction is required.

The Tiled Gallery Carousel Without JetPack plugin for WordPress is vulnerable to stored cross-site scripting in all versions up to and including 3.1. Insufficient input sanitization and output escaping in the 'data-image-title' parameter allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts into pages.