CVE Vulnerability Catalog

Progress MOVEit Transfer contains an insufficient session expiration vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The Client Certificates module of Progress MOVEit Transfer contains an incorrect authorization vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The LDAP module of Progress MOVEit Transfer is vulnerable to LDAP injection due to improper neutralization of special elements in LDAP queries. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The OIDC module of Progress MOVEit Transfer contains an authentication bypass by capture-replay vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The Ad Hoc module of Progress MOVEit Transfer contains a cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

The LDAP module of Progress MOVEit Transfer contains a missing critical step in authentication vulnerability. The issue affects versions before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Authentication bypass using an alternate path or channel vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

Before util-linux 2.41.4, `parse_dos_extended()` in `libblkid/src/partitions/dos.c` computes an extended-partition start sector with 32-bit addition and does not apply the extended-area bounds checks to the first two EBR entries. A local attacker who causes a crafted DOS extended-partition disk image or removable medium to be probed can wrap `cur_start + start` to sector zero and cause libblkid to report a false partition overlapping the MBR.

In util-linux 2.39.1 through 2.41.4 and 2.42 through 2.42.1, the SUID `mount` utility reads the attacker-controlled `LIBMOUNT_FORCE_MOUNT2` environment variable with `getenv()`, allowing a local low-privileged user to force the non-atomic legacy bind-mount path. With an `/etc/fstab` bind mount authorized by `user` or `users` and protected by `nosuid`, `noexec`, or `nodev`, an attacker can race the window between the initial bind mount and the remount that applies those security flags and execute a SUID program from the temporarily unprotected mount, potentially gaining root privileges.

Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach loopback and Docker host services because isValidCustomHost trusts localhost-style hosts when TRUSTED_CUSTOM_HOSTS is unset. Attackers can send /v1 requests with a crafted x-portkey-custom-host header, such as via the ollama provider, to make the gateway call internal services and return their responses.

Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked global_only. The unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args settings were not marked global_only, allowing a repository to replace the default interpreter arguments used by trusted tasks that have no explicit shell, postinstall directives, template exec operations, or hooks that fall back to the default shell. When mise appends the trusted command after the attacker-controlled interpreter arguments, the attacker-selected command can execute first with the developer account's privileges even though the local configuration was never trusted.

In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure.

Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected.

A vulnerability in Prowler (versions 5.4.0 through 5.35.0) allows an unauthenticated attacker to take over the account of a user who has not yet completed registration. This occurs because Google or GitHub login is automatically linked to an existing local account with the same email address, without verifying that the address belongs to the same person. An attacker can register an account with the victim's email address and gain persistent access to their data, including cloud credentials, scan findings, and tenant memberships.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Vulnerability in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal authentication subrequest, allowing an unauthenticated remote attacker to spoof request attributes evaluated by the external authentication provider.

Vulnerability in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before the map output variable. An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to restart or potential code execution.

Vulnerability in NGINX Gateway Fabric where the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter is rendered verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. An authenticated attacker with namespace access can inject arbitrary NGINX directives into the Gateway's data-plane config.

Incomplete fix for CVE-2026-12996. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.