CVE Vulnerability Catalog

On Tenda BE3L Pro 16.03.60.62, the formWifiBasicSet function in /goform/WifiBasicSet mishandles the security_5g argument, causing a buffer overflow. The attack can be performed remotely and a public exploit is available.

Apache Traffic Server forwards malformed 302 responses that should be rejected as parse errors because the Transfer-Encoding: chunked carve-out bypasses the rejection path. A response that two peers can read differently is stored and served, allowing cache poisoning and response-framing desync.

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. Affects versions 8.0.1–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.

Apache Pulsar Manager contains multiple critical security flaws: unauthenticated creation of administrator accounts, lack of access control for proxied Pulsar admin API requests, and potential leakage of Pulsar authentication credentials. The project is no longer maintained and no fixes will be released.

The rtpL16depay element in GStreamer has a heap-based buffer overflow due to missing validation of user-supplied data length before copying. This allows a remote attacker to execute arbitrary code in the context of the current process.

A vulnerability in Apache Pulsar's MultiRolesTokenAuthorizationProvider allows a client to be authorized with all roles listed in an unverified JWT claim. When anonymousUserRole is set and authentication fails but falls back to anonymous, an unauthenticated client can send a forged or unsigned token with arbitrary roles and be authorized, potentially gaining super-user access.

A vulnerability in Cisco products (Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, Unity Connection) related to improper neutralization of input during web page generation (CWE-79, cross-site scripting). It was discovered during an internal security review and fixed in hardening releases.

Cisco conducted an internal security review of Emergency Responder, Prime Collaboration Deployment, Unified CM, Unified CM IM&P, Unified CM SME, and Unity Connection, resulting in hardening releases. CVE-2026-76474 covers internally discovered vulnerabilities related to improper authentication (CWE-287).

Cisco's internal security review identified multiple vulnerabilities in Cisco Emergency Responder, Prime Collaboration Deployment, Unified Communications Manager, IM & Presence Service, Session Management Edition, and Unity Connection. The vulnerabilities relate to improper neutralization of special elements in output used by a downstream component (CWE-74).

A vulnerability in the database service of Cisco Expressway Series is caused by the use of persistent cookies and insufficient validation of client certificates when TLS Verify Mode is enabled for clustering. An unauthenticated remote attacker with network access can connect to the database service and invoke specific RPC commands, allowing execution of arbitrary operating system commands as root.

A vulnerability in Cisco Snort 3 software related to out-of-bounds writes (CWE-787). It was discovered during an internal security review and fixed in hardening releases.

A vulnerability in the ssh service in Lagoon core (versions prior to 2.33.1) allows an attacker to execute arbitrary code, potentially leading to elevated administrative permissions. It requires a Lagoon user account; fixed in Lagoon v2.33.2 (helm chart lagoon/lagoon-core v1.62.2).

On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. Verification runs only for the first message of a connection and the result latches the connection, so a request such as GET /status to internal_port authenticates the whole connection.

Missing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) allows a remote attacker to bypass server authentication and inject or deliver streaming frames when a server is configured with an Authenticator. Streaming frames never pass through the authentication hook, and streams can be impersonated by another socket carrying the same id.

A missing authentication for critical function vulnerability exists in Apache IoTDB versions from 2.0.0 before 2.0.11. The flaw may allow unauthorized access to important system functionality.

The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker can send an empty array header followed by a bulk string, causing an out-of-bounds write in the parser and crashing the process.

Improper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected builtin HTTP endpoints by first sending a builtin HTTP request on the same HTTP/1.1 keep-alive connection. When ServerOptions.auth is enabled and builtin HTTP services are publicly exposed, the first builtin request may mark the connection as authenticated for later requests.

Acronis Cyber Infrastructure (ACI) before builds 6.0.1-112, 6.1.1-64, and 6.2.1-71 has improper authorization checks, leading to sensitive information disclosure and manipulation.

An authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service in versions from 2.0.0 before 2.0.11. It may allow an attacker to gain access without valid credentials.