CVE Vulnerability Catalog

A vulnerability was detected in alexta69 MeTube in the DownloadQueue.__write_feed_metadata_sync function of app/ytdl.py, related to feed-metadata thumbnail fetching. Manipulation leads to server-side request forgery, and the attack may be launched remotely though it is highly complex. The issue is fixed in version 2026.09.29 (commit a3896604540223ecbb8258b41b1d745d62647d16).

A weakness was identified in unslothai unsloth in the FastSentenceTransformer._is_transformer_module_ref function of unsloth/models/sentence_transformer.py. Manipulating the Type argument causes externally-controlled input to select classes or code, and the attack may be initiated remotely. The issue is fixed in version 0.1.902-beta (commit de801746386a53a0cb26216e715a0af863b76ad9).

A flaw was found in Tencent ncnn in the ncnn::yuv420sp2rgb function (src/mat_pixel.cpp) within the Conversion API component. The manipulation results in an integer overflow. The exploit is publicly available and can be launched remotely.

A vulnerability was identified in Tencent ncnn in the matmul_transb function (src/layer/matmul.cpp) within the MatMul component. The manipulation leads to an out-of-bounds read. The exploit is publicly available and can be initiated remotely.

A vulnerability was detected in donetick in the CanDeleteHistory function (internal/chore/model/model.go) within the History Deletion Handler component. Manipulation of the AssignedTo argument results in improper authorization. The exploit is public and can be launched remotely.

In openGauss-connector-jdbc's LogFactory.java, LogFactory loads the logger class name from JDBC connection parameters via Class.forName, then directly invokes the String constructor and casts to Log. Missing asSubclass(Log.class) validation causes non-Log classes to be instantiated before type checking. When an attacker controls the logger class name in the JDBC URL or connection properties and a loadable class exists on the client classpath, unexpected class loading and constructor side effects may be triggered on the client.

A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the AddApplicationServices function in src/Catalog.API/Extensions/Extensions.cs of the Catalog API component. The manipulation leads to improper authentication, and the attack can be initiated remotely. The project was informed but has not responded.

A weakness was identified in calcom cal.com and cal.diy in the createWebhookProcedure function (packages/trpc/server/routers/viewer/webhook/util.ts) within the Webhook Handler component. Manipulation of the ID argument can lead to an authorization bypass. The attack can be launched remotely; the fixing pull request awaits acceptance.

In diem-project diem up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, the dmBaseLinkTag::text function in dmCorePlugin/lib/view/html/link/dmBaseLinkTag.php (dmWidget component) is vulnerable to cross-site scripting via manipulation of the text argument. The attack can be performed remotely and the exploit is publicly available; the project has not responded to the report.

In openGauss-server's hll.cpp, the HllObjectUnpack() function has a length validation flaw. After parsing lenUsed and lenTotal from user-supplied packed HLL, it only checks that input length covers HLL_HEAD_SIZE + lenUsed, then allocates a buffer by lenTotal and copies via memcpy_s() by lenUsed, without validating lenTotal >= lenUsed and passing lenUsed instead of lenTotal as destination size. A regular database user can craft a malformed packed HLL (e.g., via ::hll into hll_in()) to trigger a server-side heap overflow.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain Missing Authorization (CWE-862) and Insecure Default Initialization (CWE-1188) in the MCP proxy and OIDC registration flow. Public disclosure of OIDC configuration via GET /info and auto-enrollment of any valid OIDC token holder via POST /register without claim filtering or ban checks allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server. An unauthenticated remote libp2p peer can bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services, including command/stdio-backed MCP servers, A2A, and inference endpoints.

In diem-project diem up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, the dmString::random function in dmCorePlugin/lib/basic/dmString.php uses a cryptographically weak PRNG. The attack may be performed remotely but is of high complexity and difficult exploitability; the exploit is publicly available and the project has not responded to the report.

A vulnerability was determined in diem-project diem in an unknown part of dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php within the Sign-In component. Manipulation of the Referer argument causes an open redirect. The exploit is publicly disclosed and can be carried out remotely.

In diem-project diem up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, the append function in dmAdminPlugin/modules/dmConsole/actions/actions.class.php (Administrative Console component) is vulnerable to cross-site scripting via manipulation of the dm_command argument. The attack can be executed remotely and the exploit is publicly available; the project has not responded to the report.

In diem-project diem up to commit 116974edfb9a5b8bd69cb13586dc62bcdbb485ad, the html function in dmAdminPlugin/web/js/dmAdminCtrl.js (Version Check Service component) is vulnerable to cross-site scripting. The attack can be performed remotely and the exploit is publicly available; the project has not responded to the report.

A flaw in the Google Analytics Client component of diem-project diem causes improper certificate validation. Data manipulation can lead to acceptance of an invalid certificate, and the attack may be launched remotely. The exploit has been publicly disclosed and may be used.

A vulnerability exists in the Web Server default connection ports under the process name GeoWebServer.exe.

A vulnerability exists in the Web Server default connection ports under the process name GeoWebServer.exe.

A vulnerability was detected in Artifex MuPDF in the free_char_list function (source/pdf/pdf-xref.c) within the Signature Locking component. The manipulation results in a double free. The exploit is public and can be initiated remotely; a patch named 3984925b660afb8a781ddf504021e91be1bc671e is available.