CVE Vulnerability Catalog

GraphQL Scalars from 1.24.1 until 2.0.1 in GraphQLPhoneNumber uses ambiguous nested digit quantifiers that backtrack exponentially when a value contains a run of digits followed by a failing character; parseLiteral and parseValue are evaluated before authentication, so a small unauthenticated request can block the Node.js event loop.

In OpenReception versions 2.1.0 and prior, a returning client's six-digit booking PIN can be brute-forced online within the victim tenant. A successful guess yields the client's booking access token, granting access to that client's appointment tunnel with end-to-end-encrypted data and the ability to act as the client, e.g. adding or cancelling appointments. The bypass is cross-tenant: state owned by one tenant removes an authentication protection of a different tenant. At time of publication, there are no publicly available patches.

In OpenReception prior to version 2.2.1, an attacker who captures a pending invite token can replay it to obtain a passkey-registration credential and register their own passkey on the invited account, taking control of that account. For a staff or tenant-admin invite this yields access to the tenant context tied to that account. This issue has been patched in version 2.2.1.

In OpenReception prior to version 2.0.0, the account-confirmation link in emails is built from the request Host header with no allowlist. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's confirmation token and emails a link whose host comes from the request. An attacker sending one resend-confirmation with Host: attacker.example and a pending invitee's email causes that invitee to receive a confirmation email whose only link points to the attacker; if clicked, the one-time token reaches the attacker, who confirms the account on the real tenant domain and registers a passkey they control, taking over the account. All released versions through v1.1.0 are affected; no patched version exists yet. Reaching the app with a spoofed Host depends on the front proxy: the stock Caddy catch-all forwards it, while an operator with explicit per-tenant proxy blocks is not affected. This issue has been patched in version 2.0.0.

In Twisted prior to 26.10.0rc1, twisted.conch.telnet.Telnet.dataReceived appends every byte received after IAC SB to a persistent subnegotiation buffer until IAC SE is received, without applying a maximum length. Telnet option negotiation occurs before authentication, so an unauthenticated peer can omit the terminator and continuously grow the buffer. The resulting memory exhaustion can terminate the process and every service it hosts. This issue is fixed in version 26.10.0rc1.

In Twisted prior to 26.10.0rc1, twisted.words.protocols.irc.IRC.dataReceived retains all bytes received without a line feed in its per-connection buffer and applies no maximum line length. The twisted.words.service.IRCUser server subclass inherits this behavior, and buffering occurs before PASS, NICK, or USER authentication commands. An unauthenticated connection can continuously grow the buffer until the shared server process runs out of memory and drops all users. This issue is fixed in version 26.10.0rc1.

In Twisted prior to 26.10.0rc1, the twisted.words.xish.domish ExpatElementStream parser allows an unauthenticated remote peer to keep a container element open while continuously adding child elements. The parser retains the unfinished stanza as an in-memory tree without a byte or element-count limit, and XMPP pre-authentication stream parsing exposes this behavior before credentials are accepted. A single connection can therefore exhaust server memory and terminate the process. This issue is fixed in version 26.10.0rc1.

If an attacker can write to the filesystem of a container k8s cluster container, they can plant an exec credential plugin in /etc/kubernetes/admin.conf. kubectl will run that plugin as the macOS host user the next time someone pulls the cluster's kubeconfig onto the host with container k8s write-config or create and then runs kubectl against it.

In HTTP::Headers::ActionPack versions before 0.10 for Perl, _language_match interpolates each Accept-Language range into the pattern /^$range\-/i without escaping it, so regular expression syntax in the header reaches the regex engine. A crafted range can cause catastrophic backtracking and CPU exhaustion, or make choose_language die.

A buffer overflow vulnerability in the Bluetooth HCI USB transport class (subsys/usb/device_next/class/bt_hci.c) of the new USB device stack. bt_hci_tx_sync_in() copies controller-to-host HCI packets into a fixed-size buffer of USBD_MAX_BULK_MPS bytes (64 bytes) without a length check, while packets can be much larger (e.g., the Read Supported Commands event is 70 bytes). In production builds (CONFIG_ASSERT=n) this silently corrupts memory, potentially leading to remote code execution or denial of service.

The arm64 MMU backend's invalidate_tlb_page() only invalidated TLB entries for ASID 0, while memory domains use ASIDs starting at 1. As a result, after a page was evicted via demand paging, a user thread retained a valid translation to the freed frame, allowing read and write access to data later placed there.

A vulnerability in the WireGuard service in Zephyr RTOS (subsys/net/lib/wireguard/wg.c) allows the peer endpoint to be updated from an unauthenticated transport-data message. In handle_transport_data(), when the 32-bit receiver index matches no session, the code copies the datagram's source address into peer->endpoint even though no key exists to verify the message. A single spoofed UDP datagram sent to port 51820 can persistently redirect tunnel traffic to an attacker-chosen address.

Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER_PSKD with the default "J01NME", a publicly known example Joining Device Credential from OpenThread and Thread documentation. Firmware built with CONFIG_OPENTHREAD_JOINER_AUTOSTART=y without overriding the PSKd shipped with this public credential compiled in, with no build-time or run-time warning. An attacker within 802.15.4 radio range of an uncommissioned device can complete the DTLS-PSK handshake and supply an attacker-controlled operational dataset.

In virtualenv from 21.14.9 until 21.14.13, the bash bin/activate script can copy an attacker-controlled --prompt value into PS1 without escaping dollar signs or backticks when both promptvars and POSIX mode are disabled during activation. Re-enabling promptvars, running set -o posix, or starting an interactive child bash that inherits the exported PS1 can then expand command substitution in the stored VIRTUAL_ENV_PROMPT value and execute commands as the user who activates the environment. This issue is fixed in version 21.14.13.

In pypdf prior to 6.21.2, an incomplete remediation for repeated malformed cross-reference entries in GHSA-55h5-xmcq-c37v could still trigger a complete PDF stream reload during each recovery attempt even when a recovery cache was present, causing crafted cross-reference streams to produce long runtimes. This issue is fixed in version 6.21.2.

In pypdf prior to 6.21.2, an attacker can craft a PDF with a standard cross-reference table whose declared entry count exceeds what the file can contain, causing excessive processing and long runtimes when the file is opened. This issue is fixed in version 6.21.2.

pypdf before version 6.21.2 is vulnerable to an attack where a crafted PDF repeatedly references the same nonexistent indirect object. This triggers repeated full-file recovery loads and long runtimes when accessing parts such as pages. The issue is fixed in version 6.21.2.

A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of privilege and/or arbitrary code execution. HP is releasing software updates to mitigate the potential vulnerability.

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 42.11.16, 43.8.1, 44.9.1, and 45.0.0-beta.6, Electron does not block compromised eMudhra intermediate certificates in Chromium networking, Node.js tls, Node.js https, or Node.js fetch. An attacker who holds a certificate issued through one of these intermediates and can intercept network traffic can impersonate a TLS server to an affected application.

Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows authenticated users to retain stale group-based permissions across different spaces by exploiting a cache key keyed only on user id while omitting the active space, with the cached entry's TTL refreshed on every request. Attackers can create their own space to obtain an admin group designation, then switch their active space to a victim space where they hold lesser privileges, causing the stale cached admin decision to authorize elevated access and bypass group revocations or demotions.