CVE Vulnerability Catalog

In Valhalla (an open source routing engine for OpenStreetMap data) version 3.7.0 and earlier, a POST request to /sources_to_targets containing an exclude_polygons ring formed by three collinear points causes unbounded memory growth in the worker. The zero-area geometry triggers processing in src/loki/polygon_search.cc until the process is terminated by the out-of-memory killer. A single unauthenticated request can stop a public-facing worker.

In SAIL before version 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row that the destination buffer cannot hold, resulting in a forward heap overwrite that scales with image height. The issue is fixed in version 1.0.0.

In Pomerium (an identity and context-aware access proxy) before version 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback. In hosted or stateless authentication deployments, an unauthenticated attacker can obtain the receiver key from /.well-known/pomerium/hpke-public-key, provide a matching attacker-controlled sender key, and send a compressed payload to /.pomerium/callback that expands before validateSenderPublicKey rejects the sender. The issue is fixed in version 0.32.8.

In MKP (a Model Context Protocol server for Kubernetes) before version 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource. buildPodLogOpts() in pkg/k8s/subresource.go parses those values as unbounded int64 parameters, and defaultGetPodLogs() copies the returned Kubernetes log stream through io.Copy into an in-memory bytes.Buffer without an application-side cap. The issue is fixed in version 0.4.1.

In Omni (which manages Kubernetes on bare metal, virtual machines, or in a cloud) from 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in internal/backend/runtime/omni/state_access.go allow an authenticated user with the Reader role to retrieve the resource through ResourceService if the importing actor has not rotated those secrets, exposing Kubernetes, Talos, and etcd CA private keys plus the service-account key. The issue is fixed in versions 1.6.6 and 1.7.3.

In Omni before 1.6.6 and from 1.7.0 until 1.7.3, SAML.getSession in internal/pkg/auth/interceptor/saml.go checks SAMLAssertion.Used and marks it used in separate state operations. Concurrent requests carrying the same captured saml-session token can each observe the assertion as unused and obtain authentication as the victim before either update is visible. The issue is fixed in versions 1.6.6 and 1.7.3.

Apache Karaf's XmlUtils cached XML parser/transformer factories in static ThreadLocal fields on long-lived container threads. Because a ThreadLocal value outlives the OSGi bundle that created it, repeated bundle or feature install, update, or refresh operations can leave successive bundle ClassLoader's pinned in memory and unreachable for garbage collection, leading to unbounded Metaspace growth and eventual denial of service of the Karaf instance.

In Keycloak deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use security artifacts, such as JWT client assertions, DPoP proofs, or one-time password (TOTP) codes, to replay them. Successful exploitation grants unauthorized access to the token endpoint or login flow.

In uniget (a universal installer and updater for container tools) before version 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. The issue is fixed in version 0.27.6.

In ESPAsyncWebServer (an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP2350) before version 3.11.1, the multipart/form-data parser in src/WebRequest.cpp stores _boundaryPosition as an 8-bit value while _parseMultipartPostByte processes the boundary. A remote request containing an exactly 256-byte multipart boundary wraps _boundaryPosition from 255 to zero, prevents the boundary parsing loop from terminating, consumes excessive CPU, and triggers a FreeRTOS watchdog reset on affected ESP32 or ESP8266 devices. The issue is fixed in version 3.11.1.

In Frappe HR (an open-source human resources management solution) before version 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary Payments Based on Payment Mode report. In hrms/payroll/report/salary_payments_based_on_payment_mode/salary_payments_based_on_payment_mode.py, get_conditions constructs filter clauses from user-controlled values and get_data incorporates those clauses into a string-formatted SQL query, allowing extraction of arbitrary database data. The issue is fixed in 16.7.0.

In MCP Documentation Server from 1.13.0 until 1.13.1, the automatically started Web UI listens on all network interfaces (port 3080) instead of localhost by default. An unauthenticated network client can call API endpoints to enumerate, read, search, insert, and delete documents, and to read configuration, thereby tampering with the MCP assistant's knowledge base. The issue is fixed in 1.13.1.

In the Elixir protobuf library from 0.8.0 until 0.16.1, services that decode attacker-controlled protobuf bytes can be taken offline when the schema contains a self-referential or cyclic message type. The decoder recursively processes nested embedded fields without a nesting-depth limit, allowing a relatively small request to consume substantial CPU and memory and pin a BEAM scheduler. The issue is fixed in 0.16.1.

In TS3 Manager prior to 2.2.6, the /api/download handler passes the attacker-controlled port parameter to socket.connect and returns the error message as text/html without a Content Security Policy. When a logged-in operator follows a crafted link, the reflected script executes in the manager origin, and the token cookie lacking HttpOnly, Secure, and SameSite can be read. This enables operator-session hijacking and control of the managed TeamSpeak server. The issue is fixed in 2.2.6.

In the FaustWP WordPress plugin prior to 1.8.11, only the ciphertext in the token envelope is authenticated, and the 16-byte initialization vector is excluded from the HMAC. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can yield an Administrator access token and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. The issue is fixed in 1.8.11.

In Traccar prior to 6.14.0, an authenticated non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Validation checks only the first two keys, but removePermission() concatenates every map key into the SQL WHERE clause as column identifiers, enabling SQL injection and extraction of arbitrary database values, including administrator email, password hashes, and salts. The issue is fixed in 6.14.0.

In lxc-ci, images built from images/archlinux.yaml prior to the 2026-05-28 Arch Linux image publication retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic can use the shared pacman signing private key to sign modified packages that affected clients accept as trusted. Installing those packages permits arbitrary code execution as root on the client system. The issue is fixed in Arch Linux images published on or after 2026-05-28.

A stack-based buffer overflow vulnerability has been discovered in MCC Universal Library for Linux (uldaq). This may result in information disclosure or arbitrary code execution. The vulnerability affects uldaq v1.2.1 and prior versions.

A vulnerability has been found in code-projects Matrimonial System 1.0. It affects the writepartnerprefs function in /partner_preference.php, where manipulation of the education argument leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.

In NetLicensing MCP Server prior to 0.1.6, HTTP requests to /mcp that omit API key credentials pass through ApiKeyMiddleware without authentication. The downstream context then falls back to the operator's API key, allowing an unauthenticated attacker to invoke MCP tools and perform operations on licensing objects, including destructive deletes.