CVE Vulnerability Catalog

An off-by-one error was found in GLib in the gvs_tuple_is_normal function within glib/gvariant-serialiser.c. The bounds check uses > instead of >=, causing an out-of-bounds read of one byte during alignment padding checks. This flaw can lead to minor information disclosure of one byte and denial of service if the read crosses a page boundary.

A vulnerability in fzf's --listen mode causes a Denial of Service (DoS) due to inefficient HTTP body processing using repeated string concatenation, resulting in quadratic time complexity (O(n²)). A crafted POST request with many small segments can trigger excessive CPU usage, monopolizing the single-threaded HTTP server and blocking all other clients.

An integer overflow vulnerability was discovered in the fzf tool within the FuzzyMatchV2 function. When the input line length is approximately 2,200,000 bytes and the pattern length is 999 bytes, an overflow occurs, leading to invalid slice bounds. The Go runtime detects this and immediately terminates the process with a non-recoverable panic.

A flaw was found in Keycloak where a user with `manage-clients` permission can inject a hardcoded role mapper into any client. This bypasses scope restrictions and adds the `realm-admin` role to tokens, leading to privilege escalation and full administrative access to the realm.

CVE-2026-47105 has been rejected or withdrawn by its CVE Numbering Authority. It contains no vulnerability information.

A SAML authentication replay vulnerability in Rancher's Assertion Consumer Service (ACS) handler did not enforce one-time use of SAML assertion, potentially allowing person-in-the-middle attacks. Affects Rancher 2.14.0 before 2.14.3.

A vulnerability in Keycloak's Admin UI allows administrators with limited permissions to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an admin who can only search for users can use the 'brute-force-user' endpoint to access full user profiles, including sensitive information and security metadata. The issue is due to missing permission checks for the 'view' right on this specific search path.

The vulnerability allows a DoS attack via malformed HTTP/2 requests to NetScaler ADC and NetScaler Gateway. It occurs when HTTP/2 is enabled in the HTTP profile and associated with a virtual server (LB, CS, VPN) or a service configured on the device.

A flaw in the Identity Provider (IdP) mapper component of Keycloak allows an administrator with limited permissions to assign high-level administrative roles (e.g., realm-admin) to themselves or others by creating a 'Hardcoded Role' mapper. This bypasses security checks and grants full control over the entire realm.

Insufficient input validation in NetScaler ADC and NetScaler Gateway leads to memory overread if the TCP Timestamp is enabled in the TCP Profile and associated with a virtual server (type LB, CS, VPN) or a configured service.

An unauthenticated attacker can read arbitrary files on NetScaler ADC and NetScaler Gateway if access to NSIP, Cluster Management IP, or SNIP with management access is enabled.

A Blind SQL Injection vulnerability was found in Eksagate SYSGUARD 6001 due to improper neutralization of special elements in SQL commands. The issue affects versions from 2.0.2 before 6.1.16.0, and the vendor no longer supports the product.

The vulnerability in Net::BitTorrent for Perl before version 2.1.0 generates the MSE Diffie-Hellman private key using a non-cryptographic PRNG based on rand(). This allows a passive observer to recover the PRNG state from cleartext padding, then compute the private key and decrypt the connection.

A vulnerability in the Net::BitTorrent library for Perl (up to version 2.1.0) allows remote memory exhaustion via deeply nested bencoded input. The decoder has no recursion depth limit, and each recursion level keeps a copy of the buffer, causing quadratic memory consumption.

In the Net::BitTorrent library for Perl versions up to and including 2.1.0, there is a remote memory exhaustion vulnerability. The issue is the lack of an upper bound on the message-length prefix in the peer-wire framing, allowing a malicious peer to send a huge prefix and stream data, causing unbounded growth of the input buffer.

A vulnerability in Net::BitTorrent for Perl before version 2.1.0 allows writing files outside the download directory via path traversal in peer-supplied metadata. An attacker can exploit the ut_metadata extension (BEP09) to supply file names containing ".." sequences, bypassing path validation.

Redeight CMS version 1.0 stores user passwords using the MD5 algorithm without a salt. MD5 is a cryptographically broken algorithm and the lack of salting allows attackers to easily reverse the hashes using rainbow tables.

An unrestricted file upload vulnerability in Redeight CMS 1.0 allows authenticated attackers to achieve remote code execution (RCE) via the POST /admin/index.php?module=pages&mode=FileAdd endpoint. The application fails to validate file extensions and MIME types, permitting arbitrary PHP scripts to be uploaded to the /uploads/files/ directory where they are executed by the web server.

An SQL Injection vulnerability exists in Redeight CMS version 1.0 via the "userEmail" parameter in the POST "/admin/index.php" login endpoint. The application fails to sanitize user input and directly interpolates it into SQL queries without using prepared statements, allowing unauthenticated remote attackers to execute arbitrary SQL commands and extract sensitive database information.

Incorrect authentication caching in the team membership expansion of the Rancher Github authentication provider caused granting principal access to any logged in user, in 2.13 before 2.13.6 and 2.14 before 2.14.2.