CVE Vulnerability Catalog

Active Support is a Ruby support library extracted from the Rails framework. NumberToDelimitedConverter uses a lookahead-based regular expression with gsub!, which can cause quadratic time complexity on long digit strings. The issue is patched in versions 8.1.2.1, 8.0.4.1, and 7.2.3.1.

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.

In systemd (system and service manager running as PID 1), an unprivileged IPC API call with spurious data triggers an assert and freezes execution. On version v249 and older the effect is stack overwriting with attacker-controlled content, while from v250 the safety check causes an assert instead. The IPC call was added in v239, so older versions are not affected.

An incomplete fix for CVE-2024-47778 allows an out-of-bounds read in gst_wavparse_adtl_chunk(). The added check lsize + 8 > size does not account for GST_ROUND_UP_2(lsize) used in offset calculation, so odd lsize values cause the parser to advance beyond validated bounds.

A Cross-Site Scripting (XSS) vulnerability in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter allows an attacker to inject malicious scripts.

A vulnerability in the BFD library of GNU Binutils fails to validate relocation type values in crafted XCOFF files, leading to out-of-bounds memory reads. This can cause tool crashes or memory content disclosure.

Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.

The esaml library (and its forks) has an XXE vulnerability. Before signature verification, esaml parses attacker-controlled SAML messages using xmerl_scan:string/2 without disabling XML entity expansion. On Erlang/OTP before version 27, Xmerl allows entities by default, enabling pre-signature XXE attacks. An attacker can read local files (e.g., Kubernetes secrets) and include their contents in the SAML document.

A flaw was found in Keycloak: an improper access control vulnerability in the User-Managed Access (UMA) resource_set endpoint allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false restriction. This occurs due to incomplete enforcement of access control checks on PUT operations to the resource_set endpoint, enabling unauthorized modification of protected resources and impacting data integrity.

Versions of the jsrsasign package before 11.1.1 are vulnerable to division by zero, potentially leading to incorrect RSA public-key operations. An attacker can force these operations to return predetermined zero outputs, hiding 'invalid key' errors.

NSauditor 3.1.2.0 contains a buffer overflow vulnerability in the SNMP Auditor Community field, allowing local attackers to crash the application by supplying an excessively long string. Attackers can paste a large payload into the Community field and trigger the Walk function to cause a denial of service condition.

Vulnerability in jetAudio 8.1.7.20702 Basic allows local attackers to crash the application by supplying an excessively long string through the URL input handler. Attackers can trigger the crash by pasting a buffer of 5000 characters into the Open URL dialog, causing the application to terminate abnormally.

A security vulnerability has been detected in OmniPEMF NeoRhythm up to 20260308. It affects an unknown function of the BLE Interface and leads to missing authentication. The attack can only be initiated within the local network and is characterized by high complexity and difficult exploitability. The vendor was contacted but did not respond.

NordVPN 6.19.6 contains a denial of service vulnerability that allows local attackers to crash the application by submitting an excessively long string in the email input field. Attackers can paste a buffer of 100,000 characters into the email field during login to trigger an application crash.

MediaMonkey 4.1.23 contains a denial of service vulnerability that allows local attackers to crash the application by opening a specially crafted MP3 file containing an excessively long URL string. Attackers can create a malicious MP3 file with a buffer containing 4000 bytes of data appended to a URL, which causes the application to crash when the file is opened through the File > Open URL dialog.

BlueStacks 4.80.0.1060 contains a denial of service vulnerability that allows local attackers to crash the application by submitting oversized input to the search field. Attackers can paste a buffer of 100,000 'A' characters into the search field and trigger a search operation to cause the application to crash.

The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt text in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping in the 'logo-slider' shortcode. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events in certain reverse-proxy or local routing configurations. Attackers can bypass webhook authentication by exploiting loopback/proxy heuristics.

Nhost to otwarte źródło alternatywy dla Firebase z GraphQL. Przed wersją 0.12.0, obsługa przesyłania plików w usłudze przechowywania ufała nagłówkowi Content-Type dostarczonemu przez klienta, nie wykonując detekcji typu MIME po stronie serwera. To pozwalało atakującemu na przesyłanie plików z dowolnym typem MIME, omijając wszelkie ograniczenia oparte na typie MIME skonfigurowane na zasobnikach przechowywania.

In libde265 before version 1.0.17, a crafted HEVC bitstream causes an out-of-bounds heap write confirmed by AddressSanitizer. The trigger is a stale ctb_info.log2unitSize after an SPS change where PicWidthInCtbsY and PicHeightInCtbsY stay constant but Log2CtbSizeY changes, causing set_SliceHeaderIndex to index past the allocated image metadata array and write 2 bytes past the end of a heap allocation.