CVE Vulnerability Catalog

Axios from 1.16.1 until 1.20.0 in the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. The JavaScript regular-expression engine explores many separator placements before rejecting the URL. Excessive backtracking can block the Node.js event loop and cause denial of service.

Axios from 1.13.0 until 1.20.0 in Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service.

Axios from 1.13.0 until 1.20.0 in HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.connect(). Requests can bypass the intended proxy route or the caller-supplied DNS resolution policy.

DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. When FetchHashKeyName is set to an integer (IV) or floating-point (NV) value, the string pointer is invalid, so reading the key name triggers a segmentation fault.

An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operating system commands by supplying crafted input.

In kube-compare, when processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. A remote attacker can achieve arbitrary code execution on the operator's workstation. If the Docker daemon requires elevated privileges, the untrusted code may execute with root-mediated daemon privileges.

XS::Parse::Infix versions 0.40 through 0.49 for Perl incorrectly treat a number as an array reference. The wrapper function uses SvRV() instead of SvROK(), failing to validate the argument type, which can lead to a segmentation fault or dereferencing an attacker-controlled address. An application processing input (e.g., from JSON) may allow an attacker to cause a crash or potentially execute code.

In fast-mcp-telegram before version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. The URL security validation checks only the literal hostname string but never resolves DNS, allowing bypass of the denylist and fetching from loopback/private/link-local addresses. Because the fetched body is returned to the attacker as a Telegram file attachment, this is a full-read, exfiltrating SSRF.

In Network UPS Tools prior to commits 658b24e and 1aa31d1, the GitHub Actions script used to prepare NUT tarballs and update GitHub Checks statuses and PR comments was mis-structured, mixing code running with higher privileges (single-use token with write permissions) and untrusted inputs (PR source branch). A malicious PR from a fork could extract the GITHUB_TOKEN value, potentially allowing manipulation of repository contents, commit checks/statuses, or PR comments.

In Payy prior to version 1.3.0, agg_agg forwards the compacted message stream from its inner proofs into a public messages: [Field; 1000] array, but it never checks that the unused tail of the outer array is zero. A registered prover can build a valid agg_final proof for an approved rollup block while inserting an extra burn message after the real messages. RollupV1.verifyRollup() then parses that public input as a normal burn and transfers USDC from the rollup contract to the attacker. This is a severe circuit soundness failure.

Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerability in the model-loading compile path. The get_transformers_model_type() function in hf_utils.py collects model_type values from nested model configurations without enforcing a character allowlist, allowing newlines and arbitrary Python source to survive normalization. Attackers can embed a newline in a nested model_type value within a malicious model's config.json to terminate the generated import statement and execute arbitrary Python code via exec() in unsloth_compile_transformers(), achieving remote code execution as the loading user.

In Rancher Manager, a vulnerability was identified where the Fleet agent wrote resources to downstream clusters using its own cluster-admin credentials instead of the ServiceAccount pinned to the deployment. It affects multi-tenancy environments where different tenants share the same downstream clusters, potentially leading to overwritten configuration files. This issue affected SUSE Rancher Fleet 0.16 before 0.16.2, 0.15 before 0.15.7, and 0.14 before 0.14.11.

In SUSE Rancher 2.15 before 2.15.2, incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out, potentially leading to unauthorized access.

WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_write, pg_file_rename, pg_file_unlink, and pg_logdir_ls. These functions are executable by any authenticated database role with no GRANT required, because the REVOKE applied in contrib/adminpack was never carried over to WHPG core. A non-superuser can create, overwrite, rename, and delete files under the data and log directories, and can enumerate log file names. They can also append configuration directives to postgresql.auto.conf, resulting in arbitrary code execution as the postgres OS user on the next server restart or configuration reload.

A cross-tenant authorization issue was discovered in SUSE Rancher Fleet. During agent-initiated cluster registration, cluster labels supplied by the registering agent, including labels in the reserved management.cattle.io/ namespace such as the cluster display name label, were applied to the resulting upstream Cluster object. Because Fleet resolves GitRepo and Bundle targets from those cluster labels, a party able to register a cluster into a Fleet workspace namespace shared with other tenants could cause its own cluster to satisfy targeting rules that administrators intended for a different cluster. This affects SUSE Rancher Fleet 0.16 before 0.16.1, 0.15 before 0.15.6, 0.14 before 0.14.10, 0.13 before 0.13.15, 0.12 before 0.12.19 and older versions.

Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access Control vulnerability in the SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to unauthorized access.

Exam4 is affected by a local privilege escalation vulnerability in the com.extegrity.LogTool privileged helper, which communicates with the application via XPC. The [ConsoleLogHelper copyConsoleIntoFileFromStartDate:] method executes a syslog command using attacker-controlled parameters without proper sanitization, enabling command injection. Successful exploitation allows a local attacker to execute arbitrary commands with root privileges through LaunchSynchronous.

A security flaw has been discovered in Netcore NR289-GE 1.4.5102. It affects an unknown function in the file /bin/boa of the CGI Dispatcher component. Manipulation results in improper authentication. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted but did not respond.

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

Code Injection vulnerability in Logsign SIEM by Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Allows execution of arbitrary code. The issue affects versions from 6.4.101 before 6.4.117.