CVE Vulnerability Catalog

ConnMan through 2.0 has a stack-based buffer overflow in get_domains in gdhcp/client.c triggered by a DHCPv6 Reply message. It copies a fixed 1025 bytes from a DHCPv6 DOMAIN_LIST (option 24) value into a 1026-byte stack buffer dns_name regardless of the actual option length, then walks DNS labels with an unbounded loop. A crafted DHCPv6 REPLY with a DOMAIN_LIST option of at least 1025 non-zero bytes makes the label walk leave the buffer and read/write past its end. An on-link attacker can trigger this without authentication via a forged Router Advertisement (O=1) and a forged DHCPv6 REPLY.

Kruize Autotune's REST API ships without an authentication layer, and endpoints returning datasource configuration (GET /datasources and the datasource-metadata endpoint) serialize datasource objects using a default Gson configuration with no field-exclusion strategy. As a result, authentication secrets stored for each configured monitoring datasource (basic-auth passwords, bearer tokens, API keys, and OAuth2 client secrets) are returned in cleartext to any client able to reach the service. An attacker with network access can harvest these credentials and reuse them to authenticate to the backing monitoring stack.

Improper sanitization in the registration module allows reflected Cross-Site Scripting.

Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer. Authenticated low-privileged users can force the server to issue GET requests to arbitrary internal or external hosts by crafting a malicious image URL in a Pestle JSON import file.

A flaw in Node.js TLS hostname verification can cause a server certificate to be validated against a different IP address than the one the client connected to, when the host is a non-canonical IPv4 literal with a leading zero, such as `0127.0.0.1`.

A flaw in Node.js TLS hostname verification allows a certificate without a matching IP address SAN to authenticate a connection to an IPv4 address when the host is written with non-ASCII characters, such as fullwidth digits (`１２７.0.0.1`).

A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options.

Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability allowing arbitrary Python code execution via a crafted pickle file. The file is loaded through the deprecated pandas packaged builder and processed by Pandas._generate_tables via pandas.read_pickle() without validation, so calling datasets.load_dataset("pandas", ...) executes the embedded __reduce__ payload with the victim process's privileges.

An OS command injection vulnerability exists in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04, allowing attackers to execute arbitrary commands by injecting shell metacharacters.

e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The application uses user-supplied parameters (l, a, tf, ql) without validation to generate CAPTCHA images, allowing remote attackers to cause denial of service via excessive memory and CPU consumption.

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF. The vulnerability requires a user to open a malicious document on the targeted system.

In Uni-CLI prior to version 0.225.2, the legacy JSON-RPC-over-HTTP MCP transport was exposed on loopback without validating browser Origin headers. A malicious web page could send a CORS simple POST to the local /mcp endpoint and drive tools/call requests against the user's local Uni-CLI server.

In Goobi viewer from version 25.01 to before 26.05, AuthenticationEndpoint.verifyOpenIdToken does not enforce the aud claim during cryptographic validation, and the manual check only handles single-string aud values. In a multi-RP IdP setup, a token issued for a different relying party can authenticate the attacker.

In Goobi viewer prior to version 26.05, Configuration.getWebApiToken returns an empty string when the token is not configured, and AuthorizationFilter compares the supplied token against this default without checking it is non-empty. A request to a protected endpoint with an empty ?token= value is accepted.

In Kitodo.Production prior to version 3.9.2, org.kitodo.production.helper.XMLUtils exposes XML parsing helpers that build a JAXP parser with the default, non-secure configuration. An authenticated user uploading an EAD/XML file can trigger XXE injection, leading to local file disclosure and SSRF requests.

In Cacti prior to version 1.2.31, the prior blocklist ([;&| `$\n\r]) omitted single-quote, double-quote, redirect operators, subshell parens and braces. An authenticated admin could save an input_string containing these characters and bypass the check.

In obsidian-tc from 1.0.1 until 1.31.4, the create_entity, link_entities, rename_entity, unlink_entities and delete_entity tools regenerate memory notes from SQLite at the computed memory/<type>/<name>.md path without reliably preserving note ownership, so a hand-authored note or an orphan from another entity sanitizing to the same path could have its entire body overwritten. Additionally, several tools mutate SQLite before fallible filesystem work, so a later filesystem failure can leave the memory graph inconsistent with notes on disk even when the operation failed.

In obsidian-tc from 1.13.0 until 1.31.4, a Streamable HTTP deployment with `auth.jwtSecret` configured allowed bypassing human confirmation for dispatch-gated destructive tool calls. The server trusted a validly bound `requestState` as proof of approval even though that state was minted before the `elicitation/create` leg and only proved the resubmission belonged to the same call. A misbehaving or attacker-controlled client could therefore execute destructive vault operations without human approval while still requiring the caller's ordinary tool permissions.

A vulnerability in @rog0x/mcp-docker-tools version 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.

A vulnerability in @rog0x/mcp-git-tools version 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.