CVE Vulnerability Catalog

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).

Apache Airflow versions 3.1.0 through 3.1.7 /ui/dependencies endpoint returns the full DAG dependency graph without filtering by authorized DAG IDs. An authenticated user with only DAG Dependencies permission can enumerate DAGs they are not authorized to view.

Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "~" (wildcard for all DAGs). As a result, version metadata of DAGs that the requester is not authorized to access is returned.

In the Linux kernel, the audit subsystem was fixed to add missing syscalls to the read class. The "at" variants of getxattr() and listxattr() (getxattrat, listxattrat) were missing from the audit read class, allowing bypass of audit rules when reading extended attributes. The patch adds these syscalls to the read class.

In the FastMCP library before version 2.14.2, the server does not properly respect the resource parameter submitted by the client in the authorization and token request. The token is issued for the base_url passed to the OAuthProxy during initialization, not for the specific MCP server.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to canonicalize IPv4-mapped IPv6 addresses before reserved IP validation, allowing an attacker to perform SSRF attacks against internal services via IPv4-mapped IPv6 literals such as [::ffff:127.0.0.1].

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 failed to properly enforce read permissions in search API endpoints. Guest users without read permissions could access posts and files in channels via search API requests.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to use consistent error responses when handling the /mute command. An authenticated team member can enumerate private channels they are not authorized to know about via differing error messages for nonexistent versus private channels.

Nieprawidłowa neutralizacja danych wejściowych podczas generowania stron internetowych w Forcepoint Web Security (On-Prem) na systemie Windows umożliwia wystąpienie ataku typu Stored XSS. Problem ten dotyczy wersji Web Security do 8.5.6.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions, allowing a guest user to post files in channels where they lack upload_file permission by uploading files in a team where they have permission and reusing the file metadata in a POST request to a different team.

Issues in stm32 USB device driver (drivers/usb/device/usb_dc_stm32.c) can lead to an infinite while loop.

A heap-based buffer overflow (out-of-bounds read) vulnerability was found in the bfd linker component of GNU Binutils. An attacker could exploit this by convincing a user to process a specially crafted malicious XCOFF object file.

A heap-based buffer overflow vulnerability (out-of-bounds read) was found in the bfd linker of GNU Binutils. An attacker can exploit a specially crafted XCOFF object file to access sensitive information or cause an application-level denial of service.

A command injection vulnerability was found in TP-Link TL-WR802N v4, TL-WR841N v14, and TL-WR840N v6 routers. The configuration import function allows an authenticated attacker to upload a crafted configuration file, leading to OS command execution with root privileges during port-trigger processing.

The libexpat library before version 2.7.5 contains a vulnerability that causes an infinite loop while parsing DTD content. An attacker can provide specially crafted input, leading to application hang.

In libexpat before version 2.7.5, a NULL pointer dereference vulnerability exists when processing empty external parameter entity content. This can cause a crash in applications using this library.

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.

Mattermost versions 11.3.x <= 11.3.0 fail to preserve the redacted state of burn-on-read posts during deletion, allowing channel members to access unrevealed burn-on-read message contents via the WebSocket post deletion event. Advisory ID: MMSA-2026-00579.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, allowing regular users to bypass access control restrictions and register unauthorized accounts via leaked invite IDs during team creation.

Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, and 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels, allowing a removed team member to enumerate all public channels within a private team via the channel search API endpoint.