CVE Vulnerability Catalog

The Grafana MSSQL data source plugin contains a logic flaw that allows a low-privileged user (Viewer) to bypass API restrictions and trigger a catastrophic Out-Of-Memory (OOM) memory exhaustion, crashing the host container.

A flaw was found in GIMP. An integer overflow exists when processing ICO image files in the ico_read_info and ico_read_icon functions. A size calculation for image buffers can wrap around due to 32-bit integer evaluation, allowing oversized image headers to bypass security checks.

A flaw was found in p11-kit where a remote attacker could call the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior.

A vulnerability has been discovered in Grafana OSS that allows an authorization bypass in the provisioning contact points API. Users with Editor role can modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.

A malicious SCP server can send unexpected paths that could make the client application override local files outside of the working directory. This could be misused to create malicious executable or configuration files and make the user execute them. This is the same issue as in OpenSSH, tracked as CVE-2019-6111.

In the yaml library on the 1.x branch before 1.10.3 or the 2.x branch before 2.8.3, parsing a YAML document may throw a RangeError due to a stack overflow. The node resolution/composition phase uses recursive function calls without a depth bound. An attacker who can supply YAML for parsing can trigger a RangeError: Maximum call stack size exceeded with a small payload (~2–10 KB). The RangeError is not a YAMLParseError, so applications that only catch YAML-specific errors will encounter an unexpected exception type, which depending on the host application's exception handling can fail requests or terminate the Node.js process.

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.6, a path traversal vulnerability in the report template engine allows a staff-level user to read arbitrary files from the server filesystem via crafted template tags. Affected functions: `encode_svg_image()`, `asset()`, and `uploaded_image()` in `src/backend/InvenTree/report/templatetags/report.py`. This requires staff access (to upload / edit templates with maliciously crafted tags). If the InvenTree installation is configured with high access privileges on the host system, this path traversal may allow file access outside of the InvenTree source directory. This issue is patched in version 1.2.6, and 1.3.0 (or above). Users should update to the patched versions. No known workarounds are available.

A use-after-free flaw was found in libsoup's SoupServer. The `soup_server_disconnect()` function frees connection objects prematurely even when a TLS handshake is still pending, leading to a dangling pointer access and a server crash.

Mattermost Plugins versions <=11.4, 11.0.4, 11.1.3, 11.3.2, and 10.11.11.0 fail to validate incoming request size, allowing an authenticated attacker to disrupt service via the webhook endpoint.

A flaw was found in polkit. A local user can exploit this by providing a specially crafted, excessively long input to the `polkit-agent-helper-1` setuid binary via standard input (stdin). This unbounded input can lead to an out-of-memory (OOM) condition, resulting in a Denial of Service (DoS) for the system.

A flaw was found in GIMP, which is a heap buffer over-read in the PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image.

A NULL pointer dereference vulnerability was found in the Linux kernel's icmp_tag_validation() function. When hardened PMTU mode is enabled (ip_no_pmtu_disc=3) and an ICMP Fragmentation Needed packet with an inner IP header containing an unregistered protocol number is received, a kernel panic occurs in softirq context.

In the Linux kernel, mesh_matches_local() in mac80211 unconditionally dereferences ie->mesh_config. When called from mesh_rx_csa_frame(), the parsed action-frame elements may lack a Mesh Configuration IE, leaving the pointer NULL and causing a kernel NULL pointer dereference. An adjacent attacker can exploit this by sending a crafted CSA action frame with a valid Mesh ID IE but without the Mesh Configuration IE.

A vulnerability in NATS-Server before versions 2.11.15 and 2.12.6 allows a malicious client to cause unbounded memory usage before authentication via WebSockets connection. The attack requires sending a corresponding amount of data and is a milder variant of CVE-2026-27571.

A maliciously crafted TIFF file can cause image decoding to attempt to allocate up to 4GiB of memory, causing either excessive resource consumption or an out-of-memory error.

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality. An authenticated administrator can inject malicious code via crafted names containing script or HTML markup, which is stored and executed in the browsers of other users viewing the affected page.

The Grid plugin for WordPress (up to version 2.8.0) contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can inject malicious scripts that execute in the victim's browser.

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager allows an authenticated, remote attacker to perform a cross-site scripting (XSS) attack against a user of the interface. This is due to insufficient input validation.

A vulnerability in the bootloader of Cisco IOS XE Software for Cisco Catalyst 9200, ESS9300, IE9310, IE9320, IE3500, and IE3505 switches could allow an authenticated local attacker with level-15 privileges or an unauthenticated attacker with physical access to execute arbitrary code at boot time and break the chain of trust. This is due to insufficient validation of software at boot time, enabling manipulation of loaded binaries to bypass integrity checks.