CVE Vulnerability Catalog

The docker_pull module uses the realm parameter from a Docker registry's WWW-Authenticate response header as the authentication endpoint without validation. An attacker in a man-in-the-middle position could modify this header to redirect the authentication request to an arbitrary endpoint, potentially leaking authentication tokens.

In versions prior to 5.0.0, users can reset their MFA tokens via API routes that send them emails. The number of emails sent is not limited, allowing attackers to flood users' mailboxes.

Undici's HTTP/1.1 client is vulnerable to response queue poisoning on reused keep-alive sockets. An attacker-controlled upstream server can inject an unsolicited HTTP/1.1 response onto an idle socket, causing responses to be delivered to the wrong requests.

snes9x version 1.63 allows an out-of-bounds write and denial of service via a crafted .ups file.

A vulnerability in undici allows the acceptance of incorrect SameSite attribute values in the Set-Cookie header, potentially leading to a weakening of the cookie's SameSite policy. Instead of the required case-insensitive exact match, values containing 'Strict', 'Lax', or 'None' as substrings are accepted.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. A low privileged attacker with adjacent network access could exploit this vulnerability, potentially leading to information disclosure.

Inappropriate implementation in Passwords in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page.

In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

The vulnerability in HCL iControl is due to inadequate session timeout. The web application does not automatically terminate user sessions after a period of inactivity.

A vulnerability in the Oracle VM VirtualBox product (component: VMSVGA device) allows an easily exploitable attack by a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs. Attacks may significantly impact additional products, leading to unauthorized access to data.

Vulnerability in the Oracle VM VirtualBox product (component: Core) in version 7.2.8. Easily exploitable by a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs, potentially compromising the software.

A vulnerability in the Oracle VM VirtualBox product (component: VMSVGA device) allows a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs to compromise the software. Attacks may significantly impact additional products, leading to unauthorized access to data.

A vulnerability in the Oracle VM VirtualBox product (component: VMSVGA device) allows an easily exploitable attack by a high privileged attacker with access to the infrastructure where Oracle VM VirtualBox runs. Attacks may significantly impact additional products.

In Zephyr's IPv4 IGMP implementation, a use-after-free vulnerability exists in igmp_send() which reads the network interface pointer after the packet has been sent. This affects versions from v2.6.0 through v4.4.0.

OliveTin versions 3000.0.0 and prior allow access to predefined shell commands from a web interface. The ValidateArgumentType RPC endpoint does not perform any authentication or authorization checks, allowing unauthenticated users to enumerate valid action binding IDs and their argument configurations.

A path traversal vulnerability has been found in the web interface of Intelbras iNVU 7016 FT version 3.004.00IB000.0.T Build 2025-09-26, in the file /RPC2_Loadfile/syslog/. The attack can be launched remotely and an exploit has been published.

Vulnerability in Intelliants Subrion CMS up to version 4.0.3. An unknown functionality of the Blocks Endpoint component allows XSS via manipulation of the CSS class name argument. The attack can be performed remotely.

Vulnerability in the Store Locator WordPress plugin (before version 1.6.9) allows high-privileged users (e.g., administrators) to read arbitrary .php files on the server, including configuration files containing database credentials and authentication keys.

The Store Locator WordPress plugin before 1.6.9 does not sanitize store logo metadata before storing and displaying it on the admin page, allowing high-privileged users (e.g., administrators) to perform Stored XSS attacks even when `unfiltered_html` is disallowed (e.g., in a multisite network).

OpenClaw before version 2026.5.6 has an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass DM policy by sending crafted events missing channel type information to process restricted content.