CVE Vulnerability Catalog

In Reactor Core, applications using the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Affects Reactor Core 3.8.0-3.8.6 and 3.7.19 and earlier.

An attacker who can set the file_name header on a message reaching a ZipTransformer with ZipResultType.FILE (the default) can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Affects Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12.

An unauthenticated remote attacker who can send a single UDP packet to a Spring Integration UDP inbound adapter can cause the server to emit an outbound UDP datagram to an arbitrary internal or external host and port of the attacker's choosing. Affects Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

An attacker who can publish to a queue consumed by an application that has enabled message decompression can crash the consumer JVM with a single ~1 MB message. Affects Spring AMQP 4.1.0, 4.0.0-4.0.4, 3.2.0-3.2.12, and 2.4.18 and earlier.

RFC6587SyslogDeserializer, used by the Spring Integration syslog TCP inbound adapter to decode RFC 6587 / RFC 5424 frames, trusts the sender-supplied octet count of an octet-counted frame and allocates a byte array of exactly that size with no upper bound. Affects Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

In Reactor Core, applications using the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Affects Reactor Core 3.8.0-3.8.6, 3.5.0-3.7.19, and 3.4.41 and earlier.

Spring Integration's JSON to object conversion uses the json__TypeId__ header to choose the deserialization target type, and resolves that header value to a class with ClassUtils.forName and no type/package allow-list. Affects Spring Integration 7.1.0, 7.0.0-7.0.5, 6.5.0-6.5.10, 6.4.0-6.4.12, and 5.5.21 and earlier.

Spring Data REST does not preserve the persisted version (@Version) property of an aggregate root when handling an HTTP PUT against an immutable target type. Affects Spring Data REST 5.1.0, 5.0.0-5.0.6, 4.5.0-4.5.12, 4.0.0-4.4.15, and 3.7.20 and earlier.

In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Affects Reactor Netty 1.3.0-1.3.6, 1.1.0-1.2.18, and 1.0.52 and earlier.

A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw <value>), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access.

KubePi up to version 2.0.0 does not consistently validate per-cluster access in cluster-scoped APIs, allowing an authenticated user with cluster management permissions to operate on clusters outside their granted scope. This issue is fixed in version 2.0.1.

HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default, increasing the risk of sensitive data leakage and providing attackers with internal application logic and architectural details.

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server.

LimeSurvey Community Edition 7.0.5 contains an authenticated stored cross-site scripting vulnerability in the replacement-fields dialog used by the administrative question editor. This issue affects LimeSurvey 7.0.5.

A vulnerability records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials.

LibreNMS up to version 26.4.0 is vulnerable to reflected cross-site scripting in the Proxmox application view through user-supplied instance and vmid GET parameters, which are reflected into the page title without adequate encoding. This issue is fixed in version 26.5.0.

HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity, which could allow an attacker to obtain sensitive information or modify the binary.

Weblate prior to version 2026.8 does not apply permission checks in object-scoped RSS feeds, allowing unauthorized users to read change-history metadata from private projects and restricted components. On installations with anonymous access, metadata can be retrieved without authentication. This issue is fixed in version 2026.8.

Comfast CF-N1-S firmware 2.6.0.1 and CF-WR630AX (2024-01-30 build), the update_interface_png SET handler in /usr/bin/webmgnt fails to sanitize the display_name parameter. User-controlled input is concatenated via sprintf() into the unquoted shell command `/etc/rrd/graphinterface %s %s` and executed by system() with root privileges. A remote authenticated attacker can inject arbitrary commands.

A vulnerability in Comfast CF-WR630AX router version 2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config components and the timestr, display_n parameters.