CVE Vulnerability Catalog

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseelt function's namespace-prefix handling that skips an end-of-buffer check after advancing past ':'. A malicious or spoofed UPnP gateway on the local network can send a device description or SOAP reply ending in ':' within an element name to crash the client.

miniupnpc through 2.3.3 contains a one-byte heap out-of-bounds read vulnerability in the minixml parseatt function that allows malicious UPnP gateways to read past buffer bounds via crafted replies. Attackers on the local network can spoof a gateway serving device descriptions or SOAP responses ending in '=' to crash the client.

libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder. Attackers can supply a crafted Teletext stream with DRCS_MODE_6_5_4 values, causing convert_drcs to overflow chars[48][60] and crash the application.

3proxy from 0.9.7 through 1.0.1, fixed in commit 206c923, contains an uninitialized stack memory disclosure vulnerability in the SOCKS4 reply path when the external-NAT option (-Ne) is configured. An unauthenticated attacker can trigger a reply containing uninitialized bytes from the sin structure, exposing high bytes of a userspace pointer and weakening ASLR protections.

Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [settings] from an untrusted local project before trust approval and strip_local_only_settings removes only fields marked global_only. The unix_default_file_shell_args, unix_default_inline_shell_args, windows_default_file_shell_args, and windows_default_inline_shell_args settings were not marked global_only, allowing a repository to replace the default interpreter arguments used by trusted tasks that have no explicit shell, postinstall directives, template exec operations, or hooks that fall back to the default shell. When mise appends the trusted command after the attacker-controlled interpreter arguments, the attacker-selected command can execute first with the developer account's privileges even though the local configuration was never trusted.

Zulip Server through 12.1 has a vulnerability in GenericOpenIdConnectBackend that does not reject an explicitly false email_verified claim, allowing login to an existing account if a misconfigured trusted identity provider returns an email address not controlled by the user.

In OmniFaces versions before 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2, CombinedResourceHandler accepts a structurally valid deflated and base64 encoded combined resource ID without verifying that the server issued it. A forged ID can cause unbounded decoded output, add unique reconstructed IDs to a process-lifetime cache, or combine resources other than stylesheets and scripts. Because jakarta.faces.RESOURCE_EXCLUDES is not applied by this custom resolution path, a forged ID can disclose Facelets source from the webapp resource tree or META-INF/resources. In a deployment configured with the wildcard CDN mapping, a forged ID that selects omnifaces.graphic can also cause a blind, deployment-dependent server-side fetch whose destination derives partly from the request Host header. The flaw does not provide arbitrary file read or establish arbitrary-scheme or arbitrary-destination SSRF. The shared authenticity failure permits memory exhaustion and limited resource disclosure.

Angular DevTools from 1.20.0 until 1.21.1 accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An attacker who obtains a valid randomized victim tabId can direct the extension to attach to another tab via chrome.debugger and trigger breakpoints, pausing JavaScript execution and preventing interaction with the target tab, without remote code execution or privilege escalation.

Prior to 20.3.32, 21.2.24, and 22.2.0, the @angular/router URL parser stores numeric matrix parameter names and numeric outlet names as properties on initially empty JavaScript objects during Node.js server-side rendering. V8 can interpret these URL-derived keys as array indices and allocate dense backing stores sized to high numeric values, so repeated small path segments cause disproportionate per-segment heap consumption. An unauthenticated attacker can send overlapping requests containing repeated numeric matrix parameters when SSR is enabled, the router directly parses the request URL, and upstream proxies allow semicolons and multiple path segments, eventually exhausting the Node.js old-space heap and terminating the SSR worker. Pure client-side Angular applications are not affected.

Zulip Server versions through 12.1 allow guest users to receive new message events for public channels outside their subscriptions. A guest can register an event queue requesting messages from an unsubscribed public channel, or an existing queue can remain affected after access is removed, disclosing new public-channel messages to the guest.

Nezha Monitoring from 2.2.7 until 2.2.11 has a race condition in ServiceSentinel.worker where pointer-valued serviceStatusToday and serviceCurrentStatusData entries are dereferenced without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember concurrently reporting TCP or ICMP results and deleting the same service causes a nil pointer dereference, and the lack of a gRPC recovery interceptor lets the panic terminate the whole dashboard process.

A vulnerability in Prowler (versions 5.4.0 through 5.35.0) allows an unauthenticated attacker to take over the account of a user who has not yet completed registration. This occurs because Google or GitHub login is automatically linked to an existing local account with the same email address, without verifying that the address belongs to the same person. An attacker can register an account with the victim's email address and gain persistent access to their data, including cloud credentials, scan findings, and tenant memberships.

NGINX Plus and NGINX Open Source configured with ssl_session_cache shared:name:size without explicit ssl_session_ticket_key directives to automatically rotate SSL session ticket keys allow a remote unauthenticated attacker to forge client SSL sessions in a non-deterministic manner. An attacker could leverage this to bypass verification of client certificates.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in certain configurations, processing a Server Side Includes (SSI) page containing “include virtual” commands may trigger a Use-After-Free (UAF) in the NGINX worker process. This may cause memory corruption or a worker process crash. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

NGINX Gateway Fabric configured with the Gateway CRD and an authenticated gRPC connection with NGINX Agent allows a namespaced authenticated attacker with access to a service account to impersonate the authenticated NGINX Agent gRPC connection and read TLS private keys of Gateway deployments in another namespace.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module. When using HTTP/3 with the proxy_request_buffering on directive, an unauthenticated attacker may be able to inject data into the proxied request.

Vulnerability in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with ExternalAuth policy or Ingress external authentication. Client-supplied X-Forwarded-Prefix, X-Forwarded-URI, X-Original-URI, and X-Forwarded-Method headers are forwarded unsanitized into the internal authentication subrequest, allowing an unauthenticated remote attacker to spoof request attributes evaluated by the external authentication provider.

Vulnerability in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log format references the map's regex capture variables before the map output variable. An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to restart or potential code execution.

Vulnerability in NGINX Gateway Fabric where the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter is rendered verbatim, unescaped and unvalidated, into the shared data-plane nginx.conf as auth_basic "<realm>";. An authenticated attacker with namespace access can inject arbitrary NGINX directives into the Gateway's data-plane config.

Incomplete fix for CVE-2026-12996. A use-after-free in OpenVPN 2.6.0 through 2.6.22 and 2.7_alpha1 through 2.7.7 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry.