CVE Vulnerability Catalog

A Missing Release of Memory after Effective Lifetime vulnerability in the BroadBand Edge subscriber management daemon (bbe-smgd) of Juniper Networks Junos OS on MX Series allows an adjacent, unauthenticated attacker to cause a Denial of Service (DoS). If the authentication packet-type option is configured and a received packet does not match that packet type, the memory leak occurs. When all memory available to bbe-smgd has been consumed, no new subscribers will be able to login. The memory utilization of bbe-smgd can be monitored with the following show command: user@host> show system processes extensive | match bbe-smgd. The below log message can be observed when this limit has been reached: bbesmgd[<PID>]: %DAEMON-3-SMD_DPROF_RSMON_ERROR: Resource unavailability, Reason: Daemon Heap Memory exhaustion. This issue affects Junos OS on MX Series: all versions before 22.4R3-S8, 23.2 versions before 23.2R2-S5, 23.4 versions before 23.4R2-S6, 24.2 versions before 24.2R2-S2, 24.4 versions before 24.4R2, 25.2 versions before 25.2R2.

In Junos OS on MX Series with MPC10, MPC11, LC4800, LC9600 line cards and MX304, firewall filters applied to loopback interface lo0.n (where n is non-zero) are not executed when lo0.n is in the global VRF/default routing-instance. This allows an unauthenticated network-based attacker to bypass the configured firewall filter and access the device's control-plane.

An Incorrect Initialization of Resource vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on specific EX Series and QFX Series device allows an unauthenticated, network-based attacker to cause an integrity impact to downstream networks. When the same family inet or inet6 filter is applied on an IRB interface and on a physical interface as egress filter on EX4100, EX4400, EX4650 and QFX5120 devices, only one of the two filters will be applied, which can lead to traffic being sent out one of these interfaces which should have been blocked. This issue affects Junos OS on EX Series and QFX Series: 23.4 version 23.4R2-S6, 24.2 version 24.2R2-S3. No other Junos OS versions are affected.

An Incorrect Synchronization vulnerability in the management daemon (mgd) of Juniper Networks Junos OS and Junos OS Evolved allows a network-based attacker with low privileges to cause a complete Denial-of-Service of the management plane. Rapidly establishing and disconnecting NETCONF sessions triggers a locking issue that causes mgd processes to hang in an unusable state, and once the maximum number of mgd processes is reached, no new logins are possible.

A vulnerability in the CLI of Juniper Networks Support Insights (JSI) Virtual Lightweight Collector (vLWC) allows a local, high-privileged attacker to escalate privileges to root. The CLI accepts input without proper validation, enabling shell command injection executed with root permissions.

A Cross-site Scripting (XSS) vulnerability was found in Juniper Networks Junos Space in the list filter field. It allows an attacker to inject malicious script tags that, when visited by another user (including an administrator), execute commands with the target's permissions. All versions before 24.1R5 Patch V3 are affected.

In Junos OS Evolved on PTX and QFX5000 series, a classic buffer overflow in evo-aftmand/evo-pfemand allows an unauthenticated adjacent attacker to cause a DoS by sending crafted multicast packets, leading to crashes and restarts of line cards or non-line card devices.

Joomla HikaShop 4.7.4 contains a reflected XSS vulnerability allowing unauthenticated attackers to inject malicious scripts via GET parameters in the product filter endpoint. Attackers can craft malicious URLs with XSS payloads in from_option, from_ctrl, from_task, or from_itemid parameters to steal session tokens or login credentials.

Joomla Solidres 2.13.3 contains a reflected XSS vulnerability allowing unauthenticated attackers to inject malicious scripts via multiple GET parameters including show, reviews, type_id, distance, facilities, categories, prices, location, and Itemid. Attackers can craft malicious URLs with JavaScript payloads to steal session tokens, login credentials, or manipulate site content.

Joomla VirtueMart Shopping-Cart 4.0.12 contains a reflected XSS vulnerability allowing attackers to inject malicious scripts via the keyword parameter. Attackers can craft malicious URLs with script payloads in the keyword parameter of the product-variants endpoint to execute arbitrary JavaScript in victim browsers and steal session tokens or credentials.

Joomla iProperty Real Estate 4.1.1 contains a reflected XSS vulnerability allowing attackers to inject malicious scripts via the filter_keyword parameter. Attackers can craft URLs with JavaScript payloads in the filter_keyword GET parameter of the all-properties-with-map endpoint to execute arbitrary code in victim browsers and steal session tokens or credentials.

Joomla JLex Review 6.0.1 contains a reflected XSS vulnerability allowing attackers to inject malicious scripts via the review_id URL parameter. Attackers can craft malicious links containing JavaScript payloads that execute in victims' browsers when clicked, enabling session hijacking or credential theft.

The WordPress adivaha Travel Plugin 2.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manipulating the isMobile parameter. Attackers can craft malicious URLs containing JavaScript payloads in the isMobile GET parameter at the /mobile-app/v3/ endpoint to execute arbitrary code in victims' browsers and steal session tokens or credentials.

LangChain prior to 0.3.84 and 1.2.28 has incomplete f-string prompt-template validation. Some template classes (DictPromptTemplate, ImagePromptTemplate) formatted templates without enforcing attribute-access validation, and validation based on top-level field names did not reject nested replacement fields inside format specifiers, potentially evaluating expressions during formatting.

flatpak-builder from 1.4.5 to before 1.4.8 allows reading arbitrary host files via the license-files manifest key because path validation does not resolve symlinks in intermediate components. Copied files end up in the build output; the issue is fixed in 1.4.8.

Apollo MCP Server prior to 1.7.0 did not validate the Host header on incoming HTTP requests when using StreamableHTTP transport. In configurations running on localhost without additional authentication or network controls, a malicious website visited by a local user could use DNS rebinding to bypass same-origin policy and issue requests to the local MCP server.

CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled and FFM is used in Apache Tomcat. The issue affects Apache Tomcat from 11.0.0-M14 through 11.0.20, from 10.1.22 through 10.1.53, and from 9.0.92 through 9.0.116.

Improper Input Validation vulnerability in Apache Tomcat due to an incomplete fix of CVE-2025-66614. Affects Apache Tomcat versions 11.0.15 through 11.0.19, 10.1.50 through 10.1.52, and 9.0.113 through 9.0.115.

Apache Tomcat contains an Open Redirect vulnerability in the LoadBalancerDrainingValve that can redirect users to an untrusted site. This affects versions 11.0.0-M1 through 11.0.18, 10.1.0-M1 through 10.1.52, 9.0.0.M23 through 9.0.115, and 8.5.30 through 8.5.100.

In Wasmtime prior to 24.0.7, 36.0.7, 42.0.2, and 43.0.1, the implementation of transcoding strings between components does not validate the return value of a guest component's realloc before the host writes through the pointer. This enables a guest to cause the host to write arbitrary transcoded string bytes to an arbitrary location up to 4GiB away from the base of linear memory, potentially hitting unmapped memory or corrupting host data structures.