CVE Vulnerability Catalog

Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside the container.

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads.

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution.

RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(), and a remote CoAP client can send a malformed Block2 option that produces an invalid slice range and can cause out-of-bounds memory access, denial of service, or memory corruption.

Incorrect DBus policy for lomiri-download-manager allows an arbitrary user to run arbitrary commands as root over DBus.

Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows an arbitrary user to read arbitrary files as root over DBus.

In libp2p-rust, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming prior subscription. A remote unauthenticated peer can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that can exhaust process memory and cause denial of service.

In SparkyFitness, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator can upload a restore archive with a crafted filename containing shell metacharacters, allowing execution of arbitrary OS commands with server process privileges.

In pupnp, parse_hostport synchronously calls getaddrinfo while processing attacker-supplied hostnames from inbound HTTP request targets and GENA SUBSCRIBE CALLBACK headers. A remote unauthenticated peer can choose a slow or nonresponsive hostname and block a bounded miniserver worker for the resolver timeout, allowing a small number of requests to exhaust the thread pool and deny UPnP service.

libIEC61850 prior to 1.6.2 does not validate the length of the RptID field in the report-control-block write path, accepting values longer than 129 bytes. When a report is later serialized, the function passes the stack-backed buffer rptIdBuf[130] to MmsValue_setVisibleString, whose resize path frees that buffer, causing an invalid free and server crash.

In libIEC61850, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. This causes a stack buffer over-read and copies those bytes into the caller-owned listName buffer, potentially crashing the server on a defineNamedVariableList request.

In libIEC61850, parseUserInformation checks len for zero before validating the negative bufPos returned by BerDecoder_decodeLength for a truncated long-form length. The continue path swallows the error, reads buffer[-1], resets parsing, and repeats the same state, leading to an infinite CPU loop or an out-of-bounds read and process abort.

In pupnp, raw_to_int in httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before storing it as unsigned int. On LP64 systems, values greater than INT_MAX can truncate or wrap, so the HTTP parser may accept a body length different from the declared value. Fixed in 2.0.2.

In pupnp, Transfer-Encoding: chunked causes the HTTP parser to leave content_length at zero while decoded bytes accumulate in msg.entity. The g_maxContentLength checks in http_RecvMessage do not enforce the same limit on decoded chunked bodies, so a remote peer can make the process buffer an entity larger than the configured maximum. Fixed in 2.0.2.

In pupnp, ixmlNode_compare passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp, though non-namespaced attributes legitimately leave them NULL. When ixmlElement_removeAttributeNode compares two distinct attributes with the same nodeName, the comparison dereferences NULL and crashes the process. Fixed in 2.0.2.

The Discourse Doc Categories plugin prior to the verified source fix refreshes the doc category index by resolving linked titles for private messages or restricted category topics without enforcing the viewer's authorization. A user who can edit the index topic can thereby learn titles they are not authorized to view.

In libIEC61850 from 1.6.1 until 1.6.2, a successful MMS ObtainFile operation closes the file handle in a task but leaves a stale non-NULL value in a task marked as unused. If a later ObtainFile request reuses that task and destination creation fails, the cleanup path closes the stale FILE object again, allowing a remote crash of the server.

In pupnp prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML with unbounded recursion. An unauthenticated peer on the local network can supply deeply nested XML through a SOAP request, exhaust a service thread's stack, and crash the UPnP service.

In Open Zaak from 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row uses the attacker-controlled bestandspad CSV field without ensuring the resolved path remains under IMPORT_DOCUMENTEN_BASE_DIR. A client with an all-authorizations application token can supply an absolute or parent-traversal path to copy any readable file into document storage.

In TuxGuitar, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive (including the .tg file itself) whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class. When the file is opened, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with TuxGuitar process privileges. Fixed in 2.1.0.