CVE Vulnerability Catalog

ORAS CLI up to version 1.3.2 has a vulnerability to uncontrolled recursion during referrer traversal when a malicious OCI registry returns a cyclic referrer graph. This causes unbounded memory growth and process hang, which can be exploited for a client-side denial of service.

MCP PHP SDK versions 0.5.0 through 0.7.0 have a vulnerability to unbounded buffer growth in the HTTP transport when reading a Server-Sent Events stream. A malicious MCP server can send data without delimiters, causing client process memory exhaustion.

A buffer overflow vulnerability in SQLite affects source snapshots/builds containing a specific Fossil check-in. An attacker can exploit this to cause a denial of service via components related to the sqlar_uncompress function.

The Okta Privileged Access client does not reject a leading hyphen in the username portion of an SSH target, which may cause the value to be interpreted as a command-line option by the underlying SSH process.

PyOpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 have a heap out-of-bounds write vulnerability when reading a crafted deep scanline EXR file. A specially crafted file with a 'left' channel and layer-prefixed RGB channels can cause a buffer overflow and crash.

A null pointer dereference was addressed with improved input validation in iOS and iPadOS. An app may cause unexpected system termination.

A buffer overflow was addressed with improved bounds checking. This vulnerability affects Apple systems and may allow an app to cause unexpected system termination or write kernel memory.

ContiNew Admin fails to apply file-upload permission checks or file-type allowlist validation to multipart upload endpoints, allowing authenticated users to store files with arbitrary extensions.

OpenEXR versions 3.4.0-3.4.12 have an out-of-bounds read vulnerability in the HTJ2K decoder because it does not check if the header-length field (PLEN) fits within the available buffer. A crafted EXR file can cause an out-of-bounds read.

PyOpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 return stale heap data when reading a crafted deep EXR with layer-prefixed RGB channels. Prefixed channels are decoded into wrong lanes, leaving others uninitialized, potentially exposing memory contents.

OpenEXR versions before 3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13 have a crash vulnerability when processing a crafted EXR with an empty multiView header attribute. The viewFromChannelName() function indexes an empty vector, leading to a crash.

OpenEXR versions 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13 are vulnerable on ILP32 builds to a heap out-of-bounds read. A crafted RLE-compressed EXR can cause the unpacked size to truncate before allocation, leading to an out-of-bounds read and denial of service.

mediasoup versions npm 3.20.0-3.20.5 and Rust crate 0.22.0-0.22.4 have a vulnerability in the SCTP stack where state cookies are authenticated using only hardcoded values, allowing an attacker to forge a COOKIE-ECHO and establish an unauthorized SCTP association.

eml_parser before version 3.0.2 contains a stack overflow vulnerability in the header_fetch_parse function when parsing nested CFWS constructs in email headers. An attacker can send a specially crafted EML file that causes an unhandled RecursionError and aborts parsing of the entire message. This can disrupt SOC pipelines processing untrusted EML files.

eml_parser before version 3.0.2 contains a vulnerability in the clean_found_uri function that incorrectly validates URLs before unescaping HTML entities for colon, slash, or period characters. As a result, valid encoded URLs and their hostnames are rejected and omitted from extracted URL and domain lists. Email security gateways and SOC pipelines using these lists as indicators of compromise may fail to submit hidden URLs to threat intelligence feeds, reputation services, or sandboxes, allowing malicious links to bypass inspection.

github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type. The built-in coerceString and coerceBool functions (scalars.go) accept input whose type does not match the declared String, ID, or Boolean scalar instead of raising the request error that the GraphQL specification mandates. In some cases (but not any typical case of JSON sent to a website), a deeply nested value leads to an unrecoverable "fatal error: stack overflow" condition.

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.