CVE Vulnerability Catalog

The vulnerability in Apache Camel's OAuth component stems from a static token cache shared by every resolver instance in the JVM, keyed only on the token endpoint and client ID. Profiles that share an endpoint and client ID but differ in scope or client secret therefore receive each other's tokens, potentially granting broader authority or reaching a service the token was not issued for.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to bound the volume of text extracted from an uploaded PDF. An authenticated user can exhaust server memory and cause a denial of service via a crafted PDF whose compressed content stream expands into a very large amount of text.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x <= 11.10.1 fail to apply allocation limits to byte-string decode paths in the WebSocket msgpack decoder. An authenticated remote attacker can cause excessive server memory allocation via a crafted binary WebSocket frame declaring a Bin32 payload length of up to 4,294,967,295 bytes.

A flaw was found in the Infinispan Operator for Red Hat Data Grid. When cross-site (xsite) TLS is enabled, the operator launches the Gossip Router container with keystore and truststore passwords passed as plain-text command-line arguments. Container args are stored in the Pod spec and visible to any principal with get pods permission in the namespace, to node-level processes via /proc/<pid>/cmdline, and are frequently captured in audit/event logs.

The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malicious page and trick an authenticated user on the internal network into clicking buttons that activate relays, open gates, or control blinds. Due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions by visiting the malicious website.

boneIO Black excludes several API endpoints from authentication. An unauthenticated remote attacker on the local network can retrieve system logs, firmware version, serial number, MQTT username, configuration file listings, and API documentation. This data aids reconnaissance and enables targeted attacks against the device.

boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform offline dictionary attacks.

boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks CSRF tokens and does not validate Origin or Referer headers. A remote attacker can craft a malicious webpage that, when visited by a user on the internal network, sends cross-origin requests to the device, allowing the attacker to reboot the controller, toggle relay circuits, control gates and blinds, or shut down the device. Due to CVE-2026-77053 (authentication disabled by default), any user on the same internal network can trigger attacker-controlled actions.

boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-service passwords exposed, and any authenticated user can retrieve the administrative passwords in cleartext. Critically, due to CVE-2026-77053 (authentication disabled by default), an unauthenticated attacker on the same local network can retrieve all passwords.

Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3.

A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket, and the daemon does not automatically restart, resulting in a persistent denial of service.

A vulnerability was identified in iFlytek astron-agent up to 1.1.2 affecting the FileInfoV2Service.listKnowledgeByPage function in FileInfoV2Service.java of the Console Knowledge-List Endpoint component. Manipulation of the space-id argument leads to authorization bypass, and the attack may be launched remotely. The exploit is publicly available, and the vendor did not respond to the disclosure.

A security vulnerability has been detected in Kameleo up to 5.3.1 affecting unknown code of the file /general/user-info of the Local API component. Such manipulation leads to information disclosure, and the attack may be performed remotely. The vendor did not respond to the disclosure.

The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store contains recoverable eMudhra intermediate CA certificates. The issue impacts mongosh versions prior to 2.14.0 and can be resolved by updating to mongosh 2.14.0, which bundles Node.js 24.22.1 or later.

Apache SIS from version 0.7 through 1.6 opens files referenced by processed data regardless of their paths, potentially allowing a local file path to be specified. This affects GML with xlink:href attributes, WKT with datum shift grid parameter elements, and Landsat scenes with GeoTIFF band file paths. Reading stops at the first parsing error, making sensitive information leakage unlikely.

In the SQL storage module of Apache SIS, when sorting a stream of features, the clause is copied after ORDER BY without quoting the identifier character. A crafted sort clause could inject SQL into the query. This affects the sql-storage module from version 1.0 through 1.6; other modules such as sis-referencing are not impacted.

Mattermost versions <=11.9, 11.1.9, 11.5.8, 11.10.7.0 fail to validate Zoom chat line length before slicing, which allows an authenticated attacker to crash the Agents plugin by summarizing a Zoom chat transcription containing short continuation lines.

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which performs raw database queries without invoking the permission system. Attackers can supply a known phone number to the crm.integrations.api.get_contact_by_phone_number endpoint to retrieve full lead details otherwise blocked by standard API and UI access controls.

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the fixed-size epList array, corrupting heap memory for code execution or denial of service.

NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisSetCommand() that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OID_GEN_CURRENT_PACKET_FILTER or OID_802_3_MULTICAST_LIST with an out-of-range offset to read and disclose device memory.