CVE Vulnerability Catalog

Vulnerability in ATEN Unizon RpcProvider allows a remote attacker to cause a denial-of-service (DoS) without authentication. Lack of authentication before accessing RpcProvider functionality enables system overload.

Vulnerability in GStreamer qtdemux allows a remote attacker to execute arbitrary code via a stack-based buffer overflow when parsing UncompressedFrameConfigBox structures. User interaction with the library is required.

Vulnerability in pgvector before version 0.8.6 allows a database user to write data out-of-bounds when building an IVFFlat index, potentially leading to arbitrary code execution. Only 32-bit systems are affected.

Vulnerability in GitLab CE/EE (versions 11.8 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an unauthenticated user to cause a denial-of-service (DoS) due to insufficient resource throttling when processing merge request discussions.

Vulnerability in G DATA Total Security Backup Service allows a local attacker to escalate privileges via a symbolic link following attack. The attacker can delete a file and gain SYSTEM privileges.

Vulnerability in GitLab CE/EE (versions 18.0 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an authenticated user to modify another user's CI/CD configuration due to improper validation of attributes when processing pipeline schedules.

Vulnerability in Heimdall Data Database Proxy in the generateFileContent function allows an authenticated remote attacker to execute arbitrary code via CRLF injection. The attacker can gain root privileges.

Vulnerability in Flyto2 Core before version 2.26.7 allows an attacker to perform SSRF requests to internal or metadata endpoints via HTTP modules that fetch attacker-controlled URLs without validation.

Vulnerability in Flyto2 Core before version 2.26.6 allows environment variable expansion ${env.VAR} without an allowlist, bypassing the default denylist policy and exfiltrating secrets through allowed modules.

Vulnerability in Flyto2 Core before version 2.26.6 allows the llm.chat module to read provider keys (e.g., OPENAI_API_KEY) from the environment and send them in the Authorization header to an attacker-controlled server, leading to key leakage.

In Flyto2 Core prior to version 2.26.7, HTTP modules validate only the initial URL and then follow redirects without per-hop Location revalidation. This allows a public URL to redirect into internal address space and return the internal response body.

In V through version 0.5.2, an SSRF bypass vulnerability exists that allows attackers to circumvent host-based allowlists by exploiting a parser differential between net.urllib and net.http. A crafted URL with a backslash in the authority section can bypass validation and connect to an internal host.

Netty prior to versions 4.1.136.Final and 4.2.16.Final is vulnerable to a forced WebSocket upgrade via the lax V07/V08 handshaker. An attacker can send Sec-WebSocket-Version: 7 while omitting Connection: Upgrade and Upgrade: websocket headers, completing a protocol switch unrecognized by proxies, enabling HTTP request smuggling and protocol-confusion attacks.

In consul-mcp-server versions 0.1.0 through 0.1.3, the Consul backend address was not restricted, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect Consul API traffic to an attacker-controlled endpoint and potentially exfiltrate the Consul token.

The TL-WR940N v6 router has a vulnerability in its RTSP connection tracking module that leads to a stack-based buffer overflow. When a LAN client connects to a malicious RTSP server, a crafted RTSP message can trigger improper memory handling in the kernel module.

In Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS, improper certificate validation in the Devolutions Server connection handling allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate.

In Netty prior to versions 4.1.136.Final and 4.2.16.Final, the `Bzip2Decoder` handler in the compression codec pipeline is vulnerable to a denial-of-service attack via a malformed bzip2 stream that causes an infinite loop in the event-loop thread. The vulnerability exists in the RLE state machine within `Bzip2BlockDecompressor.read()`.

Netty prior to versions 4.1.136.Final and 4.2.16.Final has a resource exhaustion vulnerability in HttpContentEncoder (superclass of HttpContentCompressor). The acceptEncodingQueue accumulates attacker-controlled data without size limit, and using HTTP/1.1 pipelining can lead to memory or I/O resource exhaustion.

In the traceparser library, the decode() function has an improper input validation vulnerability. An attacker with a corrupted kernel trace event log (.kev) file can execute arbitrary code or cause a crash in processes that use libtraceparser on QNX hosts or targets.

In 7-Zip, a heap-based buffer overflow vulnerability exists in XZ decompression that allows remote code execution. User interaction is required – the victim must visit a malicious page or open a malicious file. Crafted XZ-compressed data can trigger a heap-based buffer overflow.