CVE Vulnerability Catalog

Stack-based buffer overflow and out-of-bounds write in Thales Sentinel Keys Server on Windows. The server does not check the length of the first field in the input message, allowing a local attacker to execute code as NT AUTHORITY\SYSTEM and escalate privileges.

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, the Halo 2 aggregation circuit can mishandle proof points encoded as the point at infinity. EcPointLoader::multi_scalar_multiplication places a Value::Assigned(_) base paired with Value::Constant(ONE) into its unscaled variable-base list and passes it directly to sum_with_const. The default shim delegates to halo2-lib EccChip::sum, whose incomplete affine addition assumes nonidentity input points. A prover-controlled proof point encoded as (0, 0) can therefore enter the final aggregation sum through the scalar-one shortcut and affect the MSM or accumulator computation. Practical exploitability depends on the surrounding aggregation and final-decider checks; the advisory does not establish universal acceptance of invalid proofs. This issue is fixed in version 0.2.5.

OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, OpenVmHalo2Verifier.verify accepts appExeCommit and appVmCommit as bytes32 values without checking that either is less than the BN254 scalar field modulus. Although public-value and proof-data lengths are checked, callers can provide non-canonical 256-bit encodings greater than or equal to that modulus at the Solidity wrapper boundary. Applications relying on the wrapper can therefore accept non-canonical app executable and app VM commitments, creating ambiguity between the supplied byte-level values and the field elements used by the verifier. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview.

OpenVM before 1.7.0 (and affected 2.0 and 2.1 prereleases) has a vulnerability in OpenVmHalo2Verifier.verify where raw calldata from proofData can invoke another external function instead of the verifier, accepting arbitrary app commitments and public values without proof validation.

OpenVM before 1.7.0 (and affected 2.0 and 2.1 prereleases) has a vulnerability in MemoryMerkleAir that does not forbid Merkle expansion rows at parent_height = 0 or below when expand_direction != 0. A malicious prover can fabricate a subtree and change the committed memory root without a corresponding memory operation, undermining OpenVM proof soundness.

MyTube before 1.10.3 registers static and cloud routes before API routes, leaving them outside the authentication stack even when loginEnabled=true. Unauthenticated clients can access videos, thumbnails, avatars, subtitles, and cloud signed URLs.

In MyTube prior to 1.10.3, the backend does not enforce the visitor role's public-only restriction when login is enabled and a visitor password is configured. The frontend filter is client-side only, and the middleware and video storage layer do not check the caller's role or visibility, so a visitor can enumerate and retrieve hidden videos along with their file paths.

In the OSAC operator (revision 8220502), the console-proxy RemoteConfigResolver parses Kubernetes Secret kubeconfig data without sanitizing the resulting rest.Config. An attacker able to create or modify a Secret with the osac.openshift.io/remote-cluster-kubeconfig label can supply an exec credential plugin, causing arbitrary process execution as the console-proxy service account, while an attacker-controlled server address enables SSRF from the proxy pod.

Kargo versions from 0.6.0 until 1.8.14, 1.9.9, and 1.10.8 contain two authorization flaws in the project-scoped RBAC API. An authenticated user with delegated permission to manage a Project's Roles or ServiceAccounts can confer permissions exceeding their own, enabling escalation to Project-administrator access.

In go-xrpl, a Go implementation of the XRP Ledger protocol, ParseMPTAmountBinary converts the eight-byte MPT magnitude using num.Int64() without checking it fits in 63 bits, silently wrapping positive values into negatives. Additionally, readMPTAmount accepts over-limit magnitudes, causing incorrect downstream calculations and divergence from rippled's interpretation.

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications passing user input into the DSL via keyword or symbol can produce SQL strings vulnerable to SQL injection because some formatters do not apply the suspicious-character check to entity names.

SNARK Verifier is a generic (S)NARK verifier. Prior to 0.2.5, KZG accumulator public-instance limbs are decoded without consistently enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. PlonkProof::read selects scalars using accumulator_indices and passes them to AccumulatorEncoding::from_repr. For the EVM loader, LimbsEncoding::from_repr forwards them to EvmLoader::ec_point_from_limbs in snark-verifier/src/loader/evm/loader.rs, where shl and add reconstruct coordinates before validate_ec_point checks the resulting affine point rather than the original limb bounds. The related native path in snark-verifier/src/pcs/kzg/accumulator.rs can reach assertion- or unwrap-based decoding and panic instead of returning a verification error. This allows noncanonical encodings at the verifier boundary and can crash the native verifier. Standard SDK aggregation circuits are expected to constrain accumulator limbs before this boundary, which limits practical exploitability. This issue is fixed in version 0.2.5.

PinePods before 0.9.0 allows an authenticated user to subscribe to an attacker-controlled RSS feed whose enclosure URL is stored without host/IP validation. The server performs GET/HEAD requests to internal services, enabling service enumeration, data disclosure, and cloud metadata credential theft.

In HotCRP, the `cmt:USER` search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. An authenticated user can therefore infer the author of an anonymous comment, compromising reviewer anonymity.

A vulnerability in the Arc time-series database allows cross-database authorization bypass through DuckDB I/O functions such as parquet_scan, glob, read_csv_auto, and others not covered by the denylist. The previous fix for CVE-2026-47735 did not block these aliases and functions, enabling unauthorized access to other databases' data, schemas, and statistics within the allowed root directory.

Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability. A malicious page can render a counterfeit address bar showing a trusted domain by exploiting the lack of a persistent fullscreen notification, tricking users into disclosing credentials via phishing.

In RAGFlow from 0.25.2 until 0.27.3, the POST /api/v1/agents/chat/completions endpoint invokes completion_openai and returns through the OpenAI-compatible branch before UserCanvasService.accessible() checks access to the agent. An authenticated user who knows another user's private agent UUID can execute that workflow and read its output across the user or tenant boundary.

In Pi-hole from 6.4.2 until 6.5, the root-run updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker running as pihole can replace the path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race them so chmod makes a sensitive target world-readable.

In Pi-hole prior to 6.5, getFTLPID() in utils.sh validates the pihole-owned /run/pihole-FTL.pid file with expr, rejecting only values whose first character is not a digit. An attacker with code execution as pihole can write a digit-prefixed arithmetic expression that Bash then evaluates as root, enabling command substitution execution.

In Pi-hole prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes.