CVE Vulnerability Catalog

psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite adjacent memory in the client process with server-chosen bytes. Fetching any large-object column is sufficient to trigger it.

Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains hard-coded credentials that can be extracted by decompiling bundled Flutter configuration assets such as production.json. The recovered credentials allow authentication to the production MQTT broker over TCP 1883, access to topics containing employee attendance records, personal identifiers, Base64-encoded photographs, device telemetry, and authentication material, and publishing messages to those topics.

Munshi (by Petpooja) before 2026-07-07 contained a missing authorization vulnerability in its company deletion workflow at DELETE /api/companies/{company_id}, where the application fails to enforce the dedicated company_delete permission or verify company ownership. An authenticated invited sub-user with mere access to a company can perform a hard delete of the company record.

Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment.

Improper neutralization of special elements used in a template engine in the publishing component of Amazon Virtual Engineering Workbench (VEW) could allow a remote authenticated third party to run arbitrary code with the permissions of the publishing Lambda's IAM role. This could allow access to data and resources across all tenant projects. The code is reachable through a crafted CloudFormation template body containing template engine directives submitted through the product versioning API.

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores the note parameter without sanitization in the support_ticket_note table, and src/modules/Support/templates/admin/mod_support_tickets.html.twig renders each stored support ticket note through innerHTML in the admin ticket list. A staff user with only the support.manage_tickets permission can store HTML or JavaScript that executes when another staff member opens the ticket notes. The script runs with the viewing staff member's session and privileges, can read a CSRF token and accessible client or invoice data, and can perform administrative actions available to the viewer, including a Super Administrator. The ticket detail page is not affected because its Twig rendering uses autoescaping. This issue is fixed in version 0.8.9.

OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow in the UDM Nudm_UEAU Generate Authentication Data endpoint. Attacker-controlled resynchronizationInfo.rand and auts values are passed to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An authenticated attacker with SBI access and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.

A privilege escalation issue was discovered in Rancher Manager's role-based access control. The inheritedNamespacedRules field of a GlobalRole propagated permissions into namespaces of downstream clusters without privilege-escalation validation, potentially allowing a non-administrative user to gain excessive permissions.

A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack in Nut/OS (Ethernut/Egnite) up to version 5.1. An unauthenticated attacker can send a single TCP segment with an unknown option with a zero length byte, triggering an infinite loop in NutTcpInputOptions and blocking the TCP processing thread.

Improper neutralization of quoting syntax in SQL identifier construction in the Apache Iceberg write component in AWS SDK for pandas (awswrangler) 3.5.2 through 3.17.0 might allow an authenticated remote user with permission to modify AWS Glue Data Catalog metadata to read tables accessible to a more privileged principal and write to the table that principal is updating via a crafted column name.

A stack-based buffer overflow exists in the ims_qos_npn module of Kamailio v6.1.3 and v6.1.4. The w_rx_aar_register() function copies the attacker-controlled host field from the SIP `Via` header into a fixed 46-byte stack buffer without validating its length. An unauthenticated remote attacker can trigger the vulnerability with a crafted SIP `REGISTER` request, causing stack corruption and termination of the affected Kamailio instance, resulting in denial of service.

A TOCTOU race in the Linux kernel Bluetooth L2CAP subsystem allowed an l2cap_chan to be linked to an l2cap_conn more than once, violating an invariant assumed during cleanup. The fix adds an invariant check in __l2cap_chan_add and a l2cap_lock_chan guard in l2cap_sock_bind().

A use-after-free in the Linux kernel tracing subsystem: trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock, while a concurrent rmdir of an instance removes and frees it under that lock. A module load or unload can therefore walk into a freed trace_array.

A double-free/use-after-free in the Linux kernel tracing subsystem: update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed.

A Linux kernel tracing vulnerability: incomplete event filter expressions (e.g., ending with a logical operator) left unresolved operator state, causing an out-of-bounds read (prog[-1]) or copying an out-of-bounds word into a branch target. This could be reached via PERF_EVENT_IOC_SET_FILTER on a self-targeted perf tracepoint counting event.

A use-after-free in the Linux kernel tracing/histograms subsystem: create_field_var_hist() saved a pointer to a compatible histogram (hist_data) rather than the one it created. Since find_compatible_hist() matches on keys alone, the user could remove that histogram while the target still pointed at it, leading to a use-after-free in event_hist_trigger_free().

A use-after-free in the Linux kernel tracing/histograms subsystem: find_synth_event() compared only the event basename, so registering or removing a histogram on a non-synthetic event whose basename matched a synthetic event erroneously modified the synthetic event's refcount. This could free the synthetic event while an active histogram action still held a pointer to it.

In the Linux kernel's io_uring waitid implementation, a use-after-free occurs. io_waitid_wait() clears ->head before taking ownership of the request by incrementing ->refs, allowing another thread to complete and free the request while the wake-up handler still touches it.

In the Linux kernel, the io_uring/waitid mechanism has a reference counter bug where repeated failed cancellation attempts can wrap the 31-bit reference field to zero. A later cancellation can then claim ownership and complete the request a second time.

A flaw was fixed in the Linux kernel's keyctl_describe_key(), where the key type's name could be freed by a module unload (e.g., AF_RXRPC) while the key description was being formatted. This led to a use-after-free and a page fault in string(). The fix holds key->sem across the kasprintf() call.