CVE Vulnerability Catalog

Sonatype Nexus Repository 3 allows a user holding the role create or role update permission to grant roles and privileges that the account does not hold. This can lead to privilege escalation up to full administrative access.

Nexus Repository 3 lacks an authorization check in the NuGet Components API upload path, allowing an account with only repository read and browse privileges to upload NuGet symbol packages (.snupkg). Exploitation requires a hosted NuGet repository with Symbol Server enabled, and with anonymous access enabled this precondition is met by default.

kin-openapi, a Go project for handling OpenAPI files, in versions from 0.136.0 until 0.143.0 accepts OpenAPI 3.1 array schemas without an items keyword and then dereferences the nil Schema.Items value while decoding requests and responses. A remote unauthenticated client can deterministically trigger a nil-pointer panic during ValidateRequest or ValidateResponse.

FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue.

Ansible Operator Plugins contains a Jinja2 template injection vulnerability. A low-privileged Kubernetes user can craft malicious custom resource (CR) specification values that are processed by Ansible without proper sanitization, leading to code execution in the operator pod.

A Regular-Expression Denial of Service (ReDoS) in the Markdown2 extract_metadata() function (lib/markdown2.py) of trentm markdown2 through v2.5.5 allows attackers to cause a Denial of Service (DoS) via a crafted Markdown document.

OPNsense, a FreeBSD-based firewall and routing platform, prior to 26.1.11 mishandles privilege values in ACL::hasPrivilege(). A user directly assigned both a component write privilege and user-config-readonly can be treated as lacking the read-only restriction, allowing MVC APIs to persist configuration changes.

OPNsense, a FreeBSD-based firewall and routing platform, prior to 26.1.11 allows carriage-return and line-feed characters in the WebGUI login username field. An attacker with network access to the login page can forge authentication events for another IP, adding it to the sshlockout PF table, or reset their own brute-force counter.

In OPNsense before version 26.1.11, the OpenVPN dashboard widget and connection-status view place a client common_name into data-common-name attributes without quote-safe encoding. With username-as-common-name and RADIUS or LDAP authentication, an attacker can inject an event handler and execute script in an administrator's session. Fixed in version 26.1.11.

In OPNsense before version 26.1.10, the Trust module stores attacker-controlled refid values and interpolates them into XPath expressions, allowing a user with CA Manager or Certificate Manager privileges to recover values from config.xml character by character via a boolean refcount oracle. Fixed in version 26.1.10.

Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains a use of externally-controlled format string vulnerability. This may lead to unexpected behavior or code execution.

Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains an improper authentication vulnerability. This may allow bypassing authentication mechanisms.

Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains an improper restriction of operations within the bounds of a memory buffer vulnerability. This may lead to buffer overflow and code execution.

Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains an improper neutralization of special elements used in an OS command (OS command injection) vulnerability. This may allow execution of arbitrary commands.

JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a stored XSS vulnerability in the classic project overview. This may allow script execution in a user's browser.

JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a remote code execution vulnerability via a whitelist bypass in the build messages protocol. This may lead to arbitrary code execution on the server.

JetBrains Datalore before version 2026.2.1 contains an unauthenticated path traversal vulnerability via the report blob endpoint, allowing reading of arbitrary files. This may lead to disclosure of sensitive information.

JetBrains Junie CLI before version 26.8.3 contains a code execution vulnerability via an untrusted project's MCP server configuration. This may lead to arbitrary code execution in the user's context.

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process while the tree was being freed.

In kin-openapi prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest.