CVE Vulnerability Catalog

This CVE ID was rejected as a duplicate — the reported issue is tracked under CVE-2026-18449.

The report was rejected by the CNA because the reported issue was assessed as intended functionality. This CVE ID is unused.

The report was rejected by the CNA because the reported issue could not be reproduced. This CVE ID is unused.

The report was rejected by the CNA because the reported issue was assessed as intended functionality. This CVE ID is unused.

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.

Open5GS versions 1.3.0 through 2.8.0 contain a heap out-of-bounds write vulnerability in parse_multipart(). An unauthenticated attacker can corrupt memory by supplying an empty multipart boundary.

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.

HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML.

Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by shadowing pgvector's vector type or operators. Attackers with CREATE privilege on the vectorscale schema can pre-create shadow objects and then build and query DiskANN indexes over crafted values.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress allows Code Injection. This issue affects WpEvently: from n/a through 5.7.9.

A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.0. Impacted is the function handleListIssues of the file src/handlers/issue-handlers.ts. Such manipulation of the argument state/labels leads to os command injection. The attack can be launched remotely. Upgrading to version 0.4.1 is recommended to address this issue.

A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.2 affecting packages/client/connection/src/browser-auth.ts in the Browser Auth component. The manipulation causes improper authorization and can be initiated remotely.

A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.5. This vulnerability affects the function createContext of the file packages/extensions/cordis-host-runner/src/sandbox.ts. The manipulation results in sandbox issue. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Apache Vysper, an XMPP (Jabber) server library, in all versions is missing an authentication check in its XEP-0077 (In-Band Registration) implementation. Any authenticated user can compromise other accounts. The project is retired and no fix will be released.

Apache Vysper, an XMPP (Jabber) server library, in all versions contains unbounded allocation in XML parsing, which may lead to an out-of-memory condition. The project is retired and no fix will be released.

Arm Keil MDK-Middleware versions 8.0.0–8.3.0 may allow DHCPv6 Option-Walk over-reads and unintended data retransmission. The issue affects the library's network stack.

Arm Keil MDK-Middleware version 8.3.0 may allow out-of-bounds reads and writes to the FTP Server RX buffer. The issue affects the library's FTP server component.