CVE Vulnerability Catalog

A flaw in Node.js allows a spoofed TypedArray byteLength to trigger a reachable assertion in the synchronous node:zlib APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation can result in a denial of service. Affects Node.js versions 22.x, 24.x, and 26.x.

The dns.resolveAny() function in Node.js can abort the process when a DNS response contains more than 256 A records. Repeated triggering can lead to denial of service. Affects Node.js versions 26.x, 24.x, and 22.x.

A vulnerability in Node.js in the node:sqlite module allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements directly using sqlite3_reset(), bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases.

Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Server-side request forgery (SSRF) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

A time-of-check time-of-use (TOCTOU) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.

A buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.

Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.

An improper control of generation of code (code injection) vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

A TOCTOU vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware modification between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires compromised MCU firmware with AXI manager access to unprotected SRAM.

The cmd_edl function in OreSat Firmware v1.0 has a stack-based buffer overflow. When processing the edl fw_flash command, the <filename> argument is copied to a 64-byte buffer via memcpy without proper length validation. An attacker with physical access to UART3 can exploit this.

The cryptography package for Python in versions 45.0.0 through 48.0.0 has a vulnerability in certificate chain verification. If an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard *.example.com, the verifier accepts the chain, allowing escape outside permitted names. Fixed in version 49.0.0.

Microweber CMS up to version 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system. An authenticated attacker can inject arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls. The injected script executes without user interaction for every visitor to the public blog page and within the admin post editor.

Camaleon CMS up to version 2.9.2 (fixed in commit 88ab703) contains a missing authorization vulnerability on the drafts endpoint. Any authenticated low-privileged user can create draft posts by bypassing role and permission checks, sending requests to the drafts endpoint using only session authentication.

Misskey versions from 2024.5.0 up to 2026.5.4 (pre-patch) contain a vulnerability in the Server Announcements API where insufficient permission checks allow attackers to access limited portions of data they normally couldn't view. This vulnerability occurs whether or not federation is enabled.

Misskey versions from 8.63.0 up to 2026.5.4 (pre-patch) contain a vulnerability that can cause the web client to slow down or crash when it applies a malformed theme.

Guzzle prior to versions 7.15.2 and 8.0.1 contains a vulnerability in the SetCookie::matchesDomain() method that incorrectly recognizes domains in hexadecimal or mixed-base forms (e.g., 0x7f000001) as IP addresses. Cookies set for such domains may be sent to other hosts, leading to disclosure of session identifiers or tokens.