CVE Vulnerability Catalog

Wire (gRPC/protobuf for Android, Kotlin, Swift, and Java) before 6.4.5 and 7.0.0-alpha04 does not consistently validate attacker-controlled lengths against the current logical message boundary. In Kotlin, decoding paths (e.g., ProtoAdapter.decode, internalNextLengthDelimited, ReadBuffer.readVarint, ProtoDecoder.decodeSizeDelimited) can cross logical boundaries, perform pointer arithmetic, or reserve excessive memory. An attacker supplying malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service.

Suricata (network IDS/IPS and security monitoring engine) versions 8.0.0 through before 8.0.5 can deadlock in its IP defragmentation code when processing fragmented traffic containing an encapsulated tunnel protocol whose payload is itself fragmented. Version 8.0.5 contains a fix.

A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request to the server.

Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the node issue requests to arbitrary internal addresses. Attackers can supply a malicious queue_url to the create-source API to scan internal networks and fingerprint services based on connection response differences.

Nuclei versions before 3.11.1 cache template signature verification based only on file modification time without content checksums. Attackers can replace verified templates with unsigned malicious content and restore the original modification time to bypass signature checks and execute arbitrary operating system commands.

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's _id field to escape the intended directory and write files with .json extension to arbitrary locations as root.

A vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0. The impacted element is an unknown function of the file /admins/assessments/databank/btn_functions.php?action=add. Manipulation of the difficulty_id argument results in SQL injection. Remote exploitation is possible, and the exploit is now public and may be used.

Concrete CMS before 9.5.4 authorized OAuth REST API requests based solely on the bearer token and did not re-check the state of the account the token was issued to. Deactivating, deleting, or locking a user did not revoke their outstanding tokens, so such a user retained full access to /ccm/api/1.0/* until the token expired.

SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify arbitrary employee records due to missing server-side ownership validation. Attackers can send a PUT request to the employee update endpoint with an arbitrary employee identifier and a controlled password value to take over target accounts, enumerate employee records, and retrieve sensitive personally identifiable information including private pay bulletins.

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.

A SQL injection vulnerability was detected in SourceCodester Inventory and Monitoring System 1.0, in an unknown function of /index.php via the Username argument. The attack can be launched remotely, and a public exploit is available.

A vulnerability was identified in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd, affecting top.upstudy.crm.utils.LoginUserUtil.releaseUserIdFromCookie, leading to improper authentication. The attack can be initiated remotely, and the project has not responded to the issue report.

A vulnerability was determined in GPAC 26.07.0 affecting rmt_client_handle_ws_frame in src/utils/rmt_ws.c (WebSocket Handler component). Manipulating the payload_size argument can lead to a heap-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.

Dell Repository Manager versions prior to 3.5.2 contain an Incorrect Default Permissions vulnerability. A low-privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.

SSH.NET prior to 2026.0.0 has ScpClient placing caller-supplied remote paths into the scp command, and the default RemotePathTransformation.DoubleQuote cannot safely quote every remote command interpreter. When an application passes an attacker-controlled path to a shell-based server, shell metacharacters can execute commands as the authenticated SSH user.

oras-go prior to 2.6.2 allows content/file.Store extraction of OCI layers marked io.deis.oras.content.unpack=true to write outside the store working directory. A malicious archive can create a symlink chain whose resolved target is an attacker-selected absolute path and overwrite it, even when AllowPathTraversalOnWrite is false.

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's clock skew causes BadInvalidTimestamp responses, accumulating file descriptors and memory until resource exhaustion. This issue is fixed in version 2.170.0.

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip passes downloaded archives to zipfile.ZipFile.extractall without validating member paths, allowing a malicious archive with parent-directory traversal entries to write outside the intended model directory and potentially enable code execution. This issue is fixed in version 1.14.0.