CVE Vulnerability Catalog

Text::CSV_XS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds; when the record has a syntax error, getline returns undef and never frees the array or the fields parsed before the error. A long-running process parsing untrusted CSV retains every malformed record it is sent, so repeated malformed input exhausts its memory.

Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline. With bind_columns, the parser writes each field into the caller's own scalar without taking a reference to it; when skip_empty_rows skips an empty last line, the parser frees the current field scalar without checking whether it is bound, dropping one reference from the application's variable. The "eof" mode does the same on any empty line. The variable is then freed while the application still references it, so later code uses freed memory and can crash the process.

Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements. An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical details about the vulnerability are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical details about the vulnerability are available.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid X-Arcane-Agent-Token can request /api/debug/pprof/* through a route protected by WithAdminRequired because EnvironmentPermissionSet is installed and the request continues without checking IsGlobalAdmin.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

In Arcane before 2.5.0, UpdateRegistry and TestRegistry allow the registry URL to change while preserving the stored encrypted token. A user with registries:update and registries:test permissions can repoint the registry URL to an attacker-controlled host, causing the preserved token or password to be sent to that host.

In jackson-core (since 2.16.0), the StreamReadConstraints.maxNameLength limit is not enforced while accumulating a JSON property name in character-input parsers (Reader, String, char[]). The code path reuses the much larger maxStringLength limit (default 100,000,000 characters), allowing roughly 200 MB to be allocated before an exception is thrown. Byte-input parsers (UTF-8) are not affected.

GIMP contains an integer overflow in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. Opening or previewing a specially crafted PowerVR (.pvr) file can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.

A flaw was found in GIMP where an attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer.

OpenHuman before 0.56.0 allows cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests this endpoint, switching the user's active local session to the attacker's backend account.

Sunshine from 2026.329.165800 until 2026.906.222525 accepted any client certificate that chained to a stored paired-client certificate, without requiring the presented certificate to be the exact enabled paired identity. Certificate text was compared without canonicalizing equivalent PEM encodings, allowing a previously paired client to bypass the Disable control.

LoopX from 0.0.1 until 0.4.5 in `loopx serve-status` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to status endpoints, exposing control-plane state, goal and run information, local absolute paths, private Markdown files, and dry-run configuration projections.

Incorrect permission assignment (CWE-732) in the standalone installer for EA Javelin Anticheat (versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698) on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService service configuration and executable path. This vulnerability requires non-standard manual execution of the standalone installer and does not affect standard game installations via the EA App and Steam.

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user can request records associated with another employee.

Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values.

ERPNext before 15.121.0 and 16.34.0 fails to enforce proper authorization checks on certain status modification endpoints. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks, modifying data beyond the user's permitted role.

ERPNext prior to versions 15.118.0 and 16.27.0 fails to enforce proper authorization checks in certain endpoints of the Sales Person-wise Transaction Summary report. A role-limited authenticated user can read financial transaction rows without applying the requesting user's document permission match conditions, accessing financial data beyond their permitted role.

Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causing arbitrary command execution at CLI startup outside the SDK permission controls.