CVE Vulnerability Catalog

A vulnerability in the LookPath function causes that when the PATH environment variable contains paths to executable files (rather than just directories), passing certain strings ("", ".", "..") can unexpectedly return binaries listed in PATH.

Client use of server error messages in PostgreSQL allows an untrusted server under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. A man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql might misinterpret.

The email module in Python, specifically the BytesGenerator class, improperly quotes newlines in email headers during serialization, allowing header injection. This only affects usage of LiteralHeader that does not respect email folding.

Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure.

Incomplete tracking in PostgreSQL of tables with row security allows reused queries to view or change different rows than intended. Fixes for CVE-2023-2455 and CVE-2016-2193 missed cases involving subqueries, WITH queries, and security invoker views.

NSSCryptoSignBackend.cc in Poppler before 25.04.0 does not verify adbe.pkcs7.sha1 signatures on documents, allowing potential signature forgeries.

Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc due to a misplaced isOk check.

A floating-point exception in the PSStack::roll function of Poppler before 25.04.0 can cause application crashes when handling malformed inputs associated with INT_MIN.

An out-of-bounds read vulnerability exists in libpoppler.so in Poppler through version 24.12.0 within the JBIG2Bitmap::combine function in JBIG2Stream.cc.

A heap buffer overflow flaw was found in the OpenJPEG project. It can be triggered when using the opj_decompress utility with certain options, leading to application crash or undefined behavior.

A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content.

Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URLs to be handled by mod_proxy.

Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerable to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable.

Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests.

The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause excessive memory and CPU consumption while parsing YAML, as used by Docker Compose from versions v2.27.0 to v2.29.7.

libcurl accidentally skips certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it does not detect impostors or man-in-the-middle attacks.

Security advisory GHSA-2hw4-c9m4-f2fj concerns the knative/pkg component. Verification on 2026-05-19 confirmed end-to-end amplification of 4.5×, worse than the advisory's conservative 2× claim. A Go proof of concept (cmd/poc-c2/main.go) was built.

When Git asks for credentials via a terminal prompt (without using a credential helper), it prints the host name for which the credentials are requested. This may lead to unintended disclosure of the host name.

HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.

Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it.