CVE Vulnerability Catalog

A SQL injection vulnerability in Coverity Connect SOAP API for versions 2024.6.0 through 2026.3.0. An authenticated attacker can send a crafted payload to achieve full read access to the database and execute unauthorized commands.

A use-after-free (UAF) vulnerability was discovered in the Linux kernel's POSIX CPU timers mechanism. The issue arises from a race condition during a non-leader exec() call, potentially leading to access of a freed timer object.

In the Linux kernel, the s390/pkey driver lacked a length check in the PKEY_VERIFYPROTK ioctl. The vulnerability allows user-space to supply a request structure exceeding the buffer size, potentially leading to a buffer overflow.

In the Linux kernel, the s390/pkey driver lacked a length check for the target buffer in the pkey_pckmo handler for key_to_protkey(). If the generated output exceeds the buffer length, the function fails, but without proper validation it could lead to a buffer overflow.

In proot-distro before version 5.1.6, the restore function accepted hardlink entries whose linkname referenced another installed container without verifying the source. This allows copying files between isolated containers via a crafted archive.

In ZITADEL from 2.43.0 through 2.71.19, 3.0.0 through 3.4.11, and 4.0.0 through 4.15.1, the email and phone self-management APIs allowed users to request returned verification codes without required permissions. This allows claiming ownership of other users' email addresses or phone numbers and bypassing email/phone-based security policies.

In proot-distro before version 5.1.5, installation functions extracting tar archives and Docker layers did not validate archive-controlled symlink targets. This allows planting a symlink to a host path and writing files to the host filesystem.

In Quay, a user configured in GLOBAL_READONLY_SUPER_USERS can view robot account tokens for repositories they are not a member of. This allows an attacker with read-only superuser privileges to impersonate any robot account.

In @fastify/rate-limit before version 11.2.0, rate-limit keys are based on the verbatim client IP. An IPv6 client can bypass the limit by rotating addresses or using different representations of the same address. This affects applications using this module to protect endpoints when trustProxy is enabled.

In undici before versions 7.29.0 and 8.9.0, the cache interceptor mishandles malformed Cache-Control private directives. A response with a private directive set to an empty value can be stored in the shared cache and served to other users, disclosing private data. Additionally, combining an unqualified and qualified private directive causes a TypeError that can crash the process.

An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request.

Xlight FTP Server before version 3.9.5 contains a pre-authentication stack buffer overflow vulnerability. An unauthenticated attacker can send malformed SSH packets with GCM cipher negotiation, leading to stack corruption and potentially remote code execution.

An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getdynamicRender() method in GFPDAcroForm.java. A crafted PDF with a malicious XFA stream can cause external entity expansion during PDF/UA-1 validation, leading to local file disclosure or outbound server-side requests.

An XML External Entity (XXE) vulnerability in veraPDF-validation exists in the getRichTextStringOrStreamEntryStringRepresentation() method in DictionaryKeysHelper.java. A crafted PDF with a malicious rich-text /RC or /RV entry can cause external entity expansion and reflect local file contents into the validation report.

A vulnerability in Kong Operator (with embedded KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets using only a label selector, without ingress-class or namespace restrictions. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document, halting all ingress changes.

A Heap-Based Overflow vulnerability in Autodesk AutoCAD occurs when parsing a maliciously crafted DXF file. An attacker can exploit this to cause a crash, read sensitive data, or execute arbitrary code in the context of the current process.

A vulnerability in Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets using only a label selector, without ingress-class or namespace restrictions. Duplicate CA-certificate IDs cause Kong Gateway to reject the entire configuration document, halting all ingress changes.

A missing authorization vulnerability in MWDB Core (versions >=2.2.0 and <2.19.0) in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions of the configured API key. This affects only deployments with Remote Instances configured.

Joomla Extension Gridbox from balbooa.com versions < 2.20.2 has various CSRF vectors in the admin interface.

Joomla Extension Gridbox below version 2.20.2 has a vulnerability allowing an unauthenticated attacker to read arbitrary files via the photo viewer.