CVE Catalog

A denial-of-service vulnerability has been identified in the h2o HTTP server, which supports HTTP/1.x, HTTP/2, and HTTP/3. The issue arises when the server receives a ClientHello message over TLS or QUIC that includes a zero-length SNI extension. In this scenario, the server incorrectly processes the zero-length hostname, leading to a potential segmentation violation. This vulnerability is present in h2o commits prior to 8dc37cb and has been fixed in the mentioned commit.

A denial-of-service vulnerability has been identified in Quicly, an IETF QUIC protocol implementation primarily for the H2O HTTP server. The issue arises from connection state corruption due to improper handling of Connection IDs in QUIC version 1. While Quicly's CID buffers are limited to 20 bytes, the packet decoder accepts Connection IDs of up to 255 bytes to respond to unknown QUIC versions. This discrepancy allows QUIC v1 packets with oversized CIDs to be processed, leading to buffer overruns and assertion failures. The vulnerability exists in Quicly commits prior to 8b178e6.

A denial-of-service vulnerability has been identified in H2O Quicly, an implementation of the IETF QUIC protocol. This issue arises from an assertion failure that occurs when the total number of valid handshake messages received over a CRYPTO stream within a single packet number space exceeds 32KB. The vulnerability is present in versions of Quicly prior to the commit 937d0e9.

A vulnerability allowing stateless reset injection has been identified in Quicly, an IETF QUIC protocol implementation primarily used within the H2O HTTP server. This issue arises from inadequate validation of packet entries, enabling on-path attackers to reset QUIC connections managed by Quicly. The vulnerability affects Quicly versions prior to the commit dccf5d4.

A denial-of-service vulnerability has been identified in the H2O HTTP server's Quicly library, prior to version 8b178e6. The issue arises from the library's flow control mechanism, which allows an adversarial peer to exploit the system by sending STREAM frames with minimal data. This manipulation can trick the application into allocating excessive memory to handle out-of-order data, leading to memory exhaustion. The problem is exacerbated by the default stream concurrency settings in H2O, which can quadruple the memory usage per connection.

A YAML injection vulnerability has been identified in Jupyter Enterprise Gateway versions prior to 3.3.0. The issue arises because the server interpolates untrusted environment variables into Kubernetes manifests without proper YAML-aware escaping. This flaw allows attackers to inject new fields, overwrite existing critical fields, and manipulate document boundaries to create multiple Kubernetes resources. Exploitation could lead to the creation of arbitrary resources, such as privileged pods.

A server side template injection vulnerability has been identified in Jupyter Enterprise Gateway versions 2.0.0rc2 and above, prior to 3.3.0. This vulnerability allows for remote code execution by injecting Jinja2 template expressions into environment variables used during the rendering of Kubernetes manifests. The executed code can access the Kubernetes service account token, potentially leading to a full compromise of the Kubernetes cluster by scheduling privileged pods or pods with hostPath volume mounts.

A privilege escalation vulnerability has been identified in wger, a workout and fitness management application, affecting versions prior to 2.6. This vulnerability allows gym trainers to escalate their privileges to that of a gym manager or general manager by exploiting the trainer-login endpoint. The issue arises because the permission check can be bypassed after a trainer logs in as a lower-privileged user, enabling unauthorized access to sensitive gym administration capabilities, such as member data, contract management, and personal information of other trainers and managers.

An insecure direct object reference (IDOR) vulnerability has been identified in wger, a workout and fitness management application, in versions prior to 2.6. This vulnerability allows any authenticated user to access another user's private workout session notes, exercise history, and training statistics. The issue arises in the RoutineViewSet, where the /logs/ and /stats/ actions mistakenly grant access to the owner's private data from routines marked as public templates, regardless of ownership. This exploitation can lead to unauthorized access to sensitive health-related information, violating privacy regulations such as GDPR.

A vulnerability allowing out-of-bounds write operations has been identified in Legion of the Bouncy Castle Inc. BC-LTS bcprov-lts8on, specifically on ARM architectures. This vulnerability, which affects versions 2.73.0 prior to 2.73.12.1, allows for buffer overflow conditions. The issue arises in the SHA3 and SHAKE implementations, when these memoable states are accepted from potentially untrusted sources.

A cross-site scripting vulnerability has been identified in Microsoft Office SharePoint, allowing an authorized attacker to perform spoofing over the network. This issue arises from improper neutralization of input during web page generation.

A remote code execution vulnerability has been identified in Windows Terminal, stemming from an integer overflow or wraparound issue. This vulnerability allows an unauthorized attacker to execute code on a client machine over the network. The exploitation requires the client to connect to a malicious server.

A cross-site scripting vulnerability has been identified in Windows Admin Center. This issue arises from improper input neutralization during web page generation, allowing an unauthorized attacker to perform spoofing over the network. The vulnerability affects all versions of Windows Admin Center through 2511.

A race condition vulnerability has been identified in the Windows Backup Engine, allowing an authorized attacker to elevate privileges locally. This issue arises from concurrent execution using shared resources without proper synchronization.

A vulnerability allowing an out-of-bounds read has been identified in YAML::Syck versions prior to 1.47 for Perl. This issue arises from an unbounded newline scan in the 'newline_len' function, which is part of the bundled libsyck C library. During block-scalar lexing at a document boundary, the scan pointer can advance one byte beyond the allocated heap buffer, potentially leading to the reading of adjacent memory. This vulnerability is an incomplete fix of CVE-2025-11683, affecting the same lexer path that the earlier fix did not cover. The out-of-bounds read can be triggered by loading an untrusted document that contains a block scalar at the beginning or end of the file.

A use-after-free vulnerability has been identified in YAML::Syck versions prior to 1.47 for Perl. The issue arises in the bundled libsyck C library, where an anchor name allocated by syck_strndup is improperly managed. The anchor name is stored as both a node's anchor and a key in the parser's anchors table. When the node is freed, the shared key is also released, leading to a dangling pointer. This vulnerability can be exploited by loading an untrusted YAML document that redefines an anchor, causing a read of freed memory.

A vulnerability allowing an out-of-bounds read has been identified in YAML::Syck versions prior to 1.47 for Perl. This issue arises in the base64 decoder of the bundled libsyck, where a signed-char lookup-table index is used to access a 256-entry static table. Any !!binary byte with a value of 0x80 or higher is sign-extended to a negative index, leading to a read before the table. The vulnerability can be triggered by the base64 decoder, which processes the raw bytes of any !!binary node on the default Load path, without the need for special flags. This flaw can be exploited by loading an untrusted document containing a !!binary scalar with a high-bit byte, causing the decoder to read adjacent memory and potentially leak data through the decoded result.

A vulnerability exists in the Zoom Desktop Client for Windows and the Zoom VDI Client for Windows, prior to version 7.0.0 and 7.0.10, respectively, as well as versions 6.6.15 and 6.5.18 in their respective branches. This vulnerability arises from improper input validation, which may enable an unauthenticated user to perform an account takeover via network access.

A time-of-check to time-of-use (TOCTOU) race condition has been identified in the installation and uninstallation processes of certain Zoom Clients for Windows, prior to version 6.6.14. This vulnerability could allow an authenticated local user to escalate privileges.

A cross-site scripting (XSS) vulnerability has been identified in Kirby, an open-source content management system, affecting versions prior to 4.9.1 and 5.4.1. The issue arises in the KirbyTags and image blocks components, where the URL methods failed to filter out malicious URLs that could be executed as scripts. This vulnerability impacts four first-party Kirby renderers that create links from user-supplied content: the 'link' KirbyTag, the 'link' parameter of the 'image' KirbyTag (when it doesn't point to a known file or 'self'), the 'link' field in the built-in image block, and the HTML importer for blocks. The vulnerability is triggered when content is authored by users who may not be fully trusted, allowing for the injection of harmful scripts that could be executed in the site frontend or through a compromised Panel session.

A vulnerability exists in Kirby, an open-source content management system, in versions prior to 4.9.1 and 5.4.1. The issue arises from the content-locking feature, which fails to verify a user's access permissions before disclosing lock information. This feature is designed to prevent conflicting edits by multiple users by indicating who is currently editing a model. However, the system inadvertently exposes the email addresses and identifiers of users, including those with administrative privileges, to low-privilege authenticated Panel users whose roles restrict access to user information. This flaw could be exploited to enumerate admin accounts, facilitate phishing attacks, and conduct credential-stuffing attacks against the affected Kirby installation or other sites.

A vulnerability in Jupyter Enterprise Gateway versions 2.0.0rc1 and above prior to 3.3.0 allows users to bypass restrictions that prevent launching Jupyter Notebook kernels as root. This vulnerability arises from improper validation of user ID (UID) and group ID (GID) values. By default, the gateway prohibits UID or GID values of 0, which corresponds to the root user and group. However, this restriction can be circumvented by sending specially crafted KERNEL_UID or KERNEL_GID values that include whitespace, effectively tricking the validation process. Exploiting this vulnerability enables kernels to be executed with root privileges, increasing the risk of container escapes and compromising the underlying worker node and its workloads. In a Kubernetes environment, such exploitation could jeopardize the entire cluster.

A path traversal vulnerability allowing arbitrary PHP file inclusion has been identified in Kirby, an open-source content management system. This issue affects versions 5.3.0 prior to 5.4.1. The vulnerability arises because the user ID provided during lookup was not properly validated, enabling attackers to traverse directories and include PHP files, such as plugin files, which could be executed on the server. The flaw is present in the authentication API, the users API, and any functionality that uses the $users->find() method to retrieve user information by email or ID. Additionally, the vulnerability allows for probing the existence of arbitrary directories on the server, which could be used to gather information about the server and site setup, including installed plugins and content structure.

A vulnerability exists in Kirby CMS versions prior to 4.9.1 and 5.4.1, where the `pages.access` permission is not enforced during the rendering of page drafts. This flaw allows authenticated users to access drafts of pages they should not have permission to view. The issue arises because the path resolver for the CMS router fails to properly check access rights, enabling unauthorized access to sensitive information through rendered frontend pages.

A cross-site scripting (XSS) vulnerability has been identified in Kirby, an open-source content management system, affecting versions prior to 4.9.1 and 5.4.1. The issue arises in the list field, which stores content as HTML. Unlike other field types, HTML special characters in the list field cannot be escaped without losing formatting. This vulnerability allows attackers to inject malicious HTML that is saved unsanitized and executed on the site frontend, impacting visitors and logged-in users.

A vulnerability allowing arbitrary method calls has been identified in Kirby, an open-source content management system. This issue affects Kirby versions 4.0.0 through 4.9.0 and 5.0.0 through 5.4.0. The vulnerability arises because the application did not properly validate model attributes used in collection queries. As a result, authenticated users could exploit this flaw to invoke arbitrary model methods through the REST API, potentially leading to the disclosure of sensitive information or unauthorized actions. Methods that could be called include password() and root(), which reveal the password hash and absolute filesystem path, respectively, as well as loginPasswordless(), which could escalate privileges to another user, and delete(), which could remove all queried models if the user had the necessary permissions.

A SQL injection vulnerability has been identified in the Booking for Appointments and Events Calendar – Amelia plugin for WordPress, affecting all versions up to and including 2.4.3. The issue arises in the Customer Import feature, where insufficient escaping of user-supplied parameters and inadequate preparation of the SQL query allow authenticated attackers with the wpamelia-manager role to inject additional SQL queries. This exploitation could lead to unauthorized access to sensitive information in the database.

A use-after-free and double-free vulnerability has been identified in YAML::Syck versions prior to 1.47 for Perl. The issue arises in the bundled libsyck C library when an anchor node is redefined or removed. The functions syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node associated with the anchor name, but that node can still be live on the parser's value stack. This leads to a scenario where the node is freed twice, causing a crash in the interpreter. The vulnerability can be exploited by loading an untrusted document that redefines an anchor mid-parse, resulting in a denial-of-service condition.

A divide-by-zero vulnerability has been identified in AutomationDirect Productivity Suite versions through 4.6.2.2. This vulnerability allows a local attacker to cause a system crash by exploiting the division by zero error.

A vulnerability allowing out-of-bounds read has been identified in AutomationDirect Productivity Suite versions through 4.6.2.2. This vulnerability allows a physical attacker to manipulate the length of data sent to a USB device, potentially leading to a system crash or unauthorized disclosure of kernel memory.

A vulnerability allowing out-of-bounds read has been identified in AutomationDirect Productivity Suite versions through 4.6.2.2. This vulnerability allows a local attacker to send a crafted IOCTL request that triggers kernel memory corruption, potentially leading to limited information disclosure or disruption of the affected application.

A vulnerability allowing OS command injection has been identified in WWBN AVideo versions through 29.0. The issue arises because the fix for a previous vulnerability (CVE-2026-33482) was incomplete. The 'sanitizeFFmpegCommand' function failed to remove single '&' characters, which are used as command separators in the shell. This oversight allows attackers to execute arbitrary commands by chaining them with '&', exploiting the 'execAsync' function's 'sh -c' command execution sink.

A race condition vulnerability has been identified in the installation and uninstallation processes of certain Zoom Clients for Windows. This time-of-check to time-of-use (TOCTOU) race condition could allow an authenticated local user to escalate privileges. The vulnerability affects Zoom Workplace for Windows versions prior to 7.0.5, Zoom Workplace VDI Client for Windows versions prior to 6.5.17 and 6.6.14 in their respective branches, the Zoom Workplace VDI plugin for Windows in the same version ranges, Zoom Rooms for Windows prior to 7.0.5, and Remote Control for Zoom Contact Center for Windows before version 7.0.0.

A vulnerability exists in Zoom Rooms for Windows, prior to version 7.1.0, allowing an authenticated user to escalate privileges through local access. This issue arises from improper privilege management.

A vulnerability in Docling Core versions 1.5.0 and above, prior to 2.74.1, allowed for unsafe resolution of server-provided Content-Disposition headers to local paths. This issue could be exploited in applications that accept untrusted URLs, leading to Server-Side Request Forgery (SSRF) attacks that target local files outside the user-defined cache directory.

A vulnerability in Docling Core versions 2.5.0 and above, prior to 2.74.1, allows local file access through 'file://' image references and accepts large inline 'data:' content without a size limit. This could lead to reading local files accessible by the process or excessive memory consumption from large inline data. The issue has been resolved in version 2.74.1.

A SQL injection vulnerability exists in UReport version 2.2.9 within the '/ureport/datasource/previewData' component. This vulnerability allows attackers to execute arbitrary SQL commands, accessing sensitive database information. The issue arises from inadequate filtering and validation of SQL statements, leaving the application open to injection attacks. Exploitation of this vulnerability could also lead to remote code execution, particularly in environments with misconfigured database permissions.

A vulnerability exists in the OPSWAT AppRemover Driver (ardrv.sys) in versions through 2017.10.02.1551. The issue arises in the IOCTL handler 0x2420031, where the driver allows any local user to terminate processes without proper privilege validation. This flaw can be exploited to disrupt security software or critical system processes, leading to a denial-of-service condition and potential anti-forensic advantages.

A vulnerability in WWBN AVideo versions prior to 29.0 allows for a signature verification bypass in the Authorize.Net webhook handler. This flaw enables attackers to forge webhook requests with arbitrary payment amounts and user IDs. By using a valid transaction ID from a small legitimate purchase, attackers can bypass signature validation and manipulate wallet balances on the platform. The vulnerability arises from three combined flaws: an OR logic signature bypass, payload values overriding API-fetched data, and a lack of approval checks before processing payments.

A vulnerability exists in WWBN AVideo versions prior to 29.0, where the official Docker compose configuration exposes the .env file to unauthenticated users. The Docker compose file mounts the entire project root directory as the Apache document root, which allows the .env file—containing sensitive information such as database credentials, admin passwords, and infrastructure configuration—to be served as a static file. There are no .htaccess rules or Apache configurations to block access to dotfiles, enabling exploitation that could lead to direct database access, admin panel takeover, and lateral movement within the Docker network.

A privilege escalation vulnerability has been identified in SALTO ProAccess Space software versions prior to 6.13, when the tenancy feature is enabled. This vulnerability allows an authenticated attacker to access spaces outside their assigned partition within the same ProAccess Space installation. Exploitation requires valid operator credentials.

A vulnerability in the EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat has been identified in all firmware versions up to and including 1.46. This vulnerability allows unsecured Bluetooth connections, enabling attackers to gain full access to the device without authentication. The issue arises because the thermostat's Bluetooth GATT characteristics can be accessed without prior pairing.

A buffer overflow vulnerability has been identified in the Kerlink Wirnet iStation SNMP update mechanism, specifically in KerOS versions through 4.3.3. This vulnerability allows remote attackers to cause memory corruption and disclose limited sensitive information by exploiting improper URL handling in the update process.

A vulnerability in the SNMP implementation of Kerlink Wirnet iStation 868 running KerOS versions through 4.3.3 has been identified. The issue arises from the use of a predictable SNMP community string, which is derived from hardware-dependent information. This predictability allows remote attackers to obtain sensitive information by recovering the community string with a low number of brute-force attempts. The vulnerability is compounded by an additional information disclosure issue that can be exploited to aid in the recovery of the community string.

A directory traversal vulnerability has been identified in the Kerlink Wirnet iStation 868 running KerOS versions through 4.3.3. This vulnerability allows remote attackers to exploit the SNMP update mechanism to overwrite arbitrary files on the device, potentially leading to unauthorized privileged access and full compromise of the device.

A vulnerability in Kerlink Wirnet iStation devices running KerOS versions through 4.3.3 has been identified, allowing remote attackers to access sensitive information. This issue arises from the exposure of device-specific details via mDNS, which could enable an unauthenticated attacker on the local network to gain unauthorized access to management services such as SNMP.

A code injection vulnerability has been identified in remorses/genql versions prior to 6.3.4. This issue allows an authenticated attacker to inject arbitrary JavaScript or TypeScript into the GraphQL schema that is processed by genql. The injected code is added to the generated schema.ts file and executes when the genql client is bundled and imported. This vulnerability arises from improper encoding of output, which can be exploited by manipulating type or field descriptions in the GraphQL schema.

A vulnerability exists in WireGuard Easy versions through 15.3.0, related to the generation of one-time link tokens. The vulnerability allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a limited keyspace of up to 1000 candidate tokens per client ID. The token generation method uses CRC32 over a random value restricted to the range of 0-999, creating a predictable token generation process. Attackers can exploit this vulnerability by enumerating candidate tokens against the unauthenticated '/cnf/:oneTimeLink' route, which lacks rate limiting and does not properly validate token expiration. Successfully exploiting this vulnerability allows attackers to obtain a peer's PrivateKey and PresharedKey, enabling them to impersonate that peer on the VPN network.

A vulnerability in CoreDNS versions 1.9.4 prior to 1.14.5 allows a network DNS client to trigger a panic during AXFR zone transfers. This issue arises when CoreDNS is configured to use 'k8s_external' headless-service zone transfers, and Kubernetes has a headless service endpoint without declared ports. The 'k8s_external' transferer can then send an empty batch of DNS records, which the 'transfer' plugin attempts to process, leading to a panic. In normal operation, this panic is recovered and returned as a SERVFAIL response, but it can disrupt requests and increase panic logging. If the 'debug' plugin is active, it can cause the CoreDNS process to crash.

A denial-of-service vulnerability has been identified in Centrifugo versions prior to 6.8.4. The issue arises in the unidirectional WebSocket transport when compression is enabled. The server improperly handles compressed data, allowing unauthenticated requests to the WebSocket connection endpoint to cause significant memory and CPU strain. This vulnerability exploits the WebSocket 'permessage-deflate' compression, which can inflate a small compressed frame into a large amount of uncompressed data, effectively creating a 'decompression bomb' attack. The problem is rooted in the WebSocket connection's read message handling, where the decompressed data is not subject to any size limit, contrary to the compressed data which is capped.