2,541 results · Clear filters · Feed
-
Low —
netfoil has a resource leak in LRU cache
### Summary When an entry was removed from the LRU cache, a pointer to the removed element was not properly cleaned up. ### Impact A local attacker can get netfoil to use more memory. By default this is limited to 100MB via systemd, which would trigger servic…
-
Low 3.3
uutils coreutils cut Local Logic Error and Data Integrity Issue in Output Filtering
A logic error in the cut utility of uutils coreutils causes the utility to ignore the -s (only-delimited) flag when using the -z (null-terminated) and -d '' (empty delimiter) options together. The implementation incorrectly routes this specific combination th…
-
Low 3.4
uutils coreutils mknod Security Label Inconsistency and Broken Cleanup on SELinux Systems
The mknod utility in uutils coreutils fails to handle security labels atomically by creating device nodes before setting the SELinux context. If labeling fails, the utility attempts cleanup using std::fs::remove_dir, which cannot remove device nodes or FIFOs.…
-
Low 2.0
linuxfabrik-lib: Insecure creation of SQLite databases
linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations. Prior to version 4.2.0, db_sqlite.py created SQLite databases at predictable paths in the shared /tmp directory and followed attacker-created symbolic…
-
Low 3.6
uutils coreutils Missing TOCTOU Protection on Non-Linux Unix Platforms in Safe Traversal Module
The safe_traversal module in uutils coreutils, which provides protection against Time-of-Check to Time-of-Use (TOCTOU) symlink races using file-descriptor-relative syscalls, is incorrectly limited to Linux targets. On other Unix-like systems such as macOS and…
-
Low 3.3
uutils coreutils mkdir Permission Exposure Race Condition with -m
The mkdir utility in uutils coreutils incorrectly applies permissions when using the -m flag by creating a directory with umask-derived permissions (typically 0755) before subsequently changing them to the requested mode via a separate chmod system call. In m…
-
Low 3.3
uutils coreutils id Misleading Identity Reporting in Pretty Print Mode
The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the ef…
-
Low 3.3
uutils coreutils cut Inconsistent Output Suppression with Newline Delimiters
The cut utility in uutils coreutils incorrectly handles the -s (only-delimited) option when a newline character is specified as the delimiter. The implementation fails to verify the only_delimited flag in the cut_fields_newline_char_delim function, causing th…
-
Low 3.3
uutils coreutils ln Local Denial of Service via Improper Handling of Non-UTF-8 Filenames
A logic error in the ln utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., ln SOURCE... DIRECTORY). While GNU ln treats filenames as raw bytes and creates the link…
-
Low 3.3
uutils coreutils comm Silent Data Corruption via Lossy UTF-8 Normalization
The comm utility in uutils coreutils silently corrupts data by performing lossy UTF-8 conversion on all output lines. The implementation uses String::from_utf8_lossy(), which replaces invalid UTF-8 byte sequences with the Unicode replacement character (U+FFFD…
-
Low 3.3
uutils coreutils mktemp Insecure Temporary File Placement via Empty TMPDIR
The mktemp utility in uutils coreutils fails to properly handle an empty TMPDIR environment variable. Unlike GNU mktemp, which falls back to /tmp when TMPDIR is an empty string, the uutils implementation treats the empty string as a valid path. This causes te…
-
Low 2.1
Email-derived URL path injection in the Swoosh Microsoft Graph adapter
URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In a…
-
Low 3.7CVE-2026-46584 Public exploit
Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component. The camel-mail producer (MailProducer.getSender) scanned the outgoing Exchange for message headers in the mail.smtp. / mail.smt…
-
Low 1.9
Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Encryption 4.0.0 through 4.1.0, configuring `encrypt:rsa:algorithm=OAEP` does not enable OAEP encryption. Du…
-
Low 3.7
Zebra has pre-handshake buffer capacity reservation based on attacker-claimed body length
### Am I affected You are affected if: 1. You run `zebrad` up to and including `v4.4.1`. 2. Your node accepts inbound P2P connections (`network.listen_addr` is set, which is the default). ### Summary The P2P codec's `Codec::decode()` method calls `src.reserve…
-
Low 3.7
Zebra before 4.5.0 CPU Amplification via Uncapped getblocks/getheaders Locator Length
Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 loca…
-
Low 2.9
Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC(), while manager/handlers/oauth.go retur…
-
Low 3.7
SFTPGo: Stored XSS via inline parameter on public shares and user file download
SFTPGo is an open source, event-driven file transfer solution. From 2.2.0 until 2.7.3, the inline query parameter on browsable-share file downloads and authenticated user-file downloads suppresses Content-Disposition: attachment, allowing an attacker-controll…
-
Low 2.0
RustCrypto Cmov/CmovEq on aarch64 can produce wrong results if high-bits of registers are set
RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/b…
-
Low 3.8
OpenClaw < 2026.4.25 - Provider Alias Confusion in Embedded Runner Policy
OpenClaw before 2026.4.25 contains a policy bypass vulnerability in embedded runner policy that allows requests using provider aliases to compare against aliases instead of canonical provider identities. Attackers can exploit this confusion to select bundled …
-
Low 3.7
OpenClaw < 2026.5.6 - Missing Channel Type Validation in Mattermost Event Handlers
OpenClaw before 2026.5.6 contains an improper access control vulnerability in Mattermost event handlers that fails to validate channel type metadata. Attackers can bypass intended DM policy decisions by sending crafted Mattermost events missing channel type i…
-
Low 2.1
oras-go: Malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to int…
-
Low 3.7
Edgeless Systems Contrast through 1.20.0 Credential Leak via Registry Suffix Matching
Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller. Config.registryFor strips a single trailing dot and then uses strings.HasSuffix(hostname, fqdn) without requiring a DN…
-
Low —
Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
Schema.org has a cross-site scripting (XSS) vulnerability via script break-out in toScript() output.
-
Low 3.3
Open Babel PQSformat.cpp ReadMolecule null pointer dereference
A vulnerability was determined in Open Babel up to 3.1.1. This affects the function PQSFormat::ReadMolecule of the file /src/formats/PQSformat.cpp. This manipulation causes null pointer dereference. The attack is restricted to local execution. The exploit has…
-
Low 3.3
Open Babel cacaoformat.cpp SetHilderbrandt null pointer dereference
A vulnerability was found in Open Babel up to 3.1.1. The impacted element is the function CacaoFormat::SetHilderbrandt of the file /src/formats/cacaoformat.cpp. The manipulation results in null pointer dereference. The attack is only possible with local acces…
-
Low 3.3
Open Babel chemkinformat.cpp ReadReactionQualifierLines null pointer dereference
A vulnerability has been found in Open Babel up to 3.1.1. The affected element is the function ChemKinFormat::ReadReactionQualifierLines of the file /src/formats/chemkinformat.cpp. The manipulation leads to null pointer dereference. The attack can only be per…
-
Low 2.0
Sigstore Java has a vulnerability with bundle verification of integratedTime
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. Version 2.0.0 erroneously removed verification of the integrated (Rekor entry) time) against the Fulcio certificate. Version 2.1.0 re-added this verification with enhancemen…
-
Low 2.3
Cross-site scripting in MDEx via unescaped highlight_lines_class code-fence attribute
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leandrocp MDEx allows stored or reflected cross-site scripting via attacker-controlled Markdown. When syntax highlighting and full info-string forwarding (re…
-
Low 3.5
Statamic: Incorrect authorization lets view-only users submit Live Preview content reserved for editors
Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.0 and 6.20.3, the Live Preview endpoint for existing entries and terms in src/Http/Controllers/CP/PreviewController.php only checked view authorization, but it accepts and re…
-
Low 1.3
Authelia has an Edge Case Access Control Rule Mismatch
Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web portal. In versions 4.36.0 through 4.39.19, due to lack of canonicalization of domains in very specific …
-
Low 3.0
PhpWeasyPrint vulnerable to arbitrary file deletion at shutdown via public $temporaryFiles
PhpWeasyPrint is a PHP library allowing PDF generation from a URL or an HTML page. Prior to version 2.6.0, `AbstractGenerator::$temporaryFiles` is a public array, and `removeTemporaryFiles()` — invoked from `__destruct()` and from a registered shutdown functi…
-
Low 3.0
Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy
In the Aimeos Pagible content management system prior to version 0.10.4, the administrative proxy route (`cmsproxy`) is vulnerable to a Server-Side Request Forgery (SSRF) attack via DNS Rebinding. A Time-of-Check to Time-of-Use (TOCTOU) race condition exists …
-
Low 2.3
Cargo can be coerced to share credentials between registries
Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crat…
-
Low —
nebula-mesh: Signed-poll nonce LRU is in-memory and bounded; replay survives restart + eviction
`internal/api/pop/nonce.go:25,40,86` + `internal/api/server.go:38` — the signed-poll nonce cache is an in-process LRU sized at 65,536 entries. `internal/api/updates.go:31` sets `pollClockSkew = 5 * time.Minute` as the replay window. ## Affected All released v…
-
Low 2.1
Incus: CreateCustomVolumeFromBackup nil-pointer dereference on volume_snapshots[*].expires_at (sibling-field variant of GHSA-r7w7)
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).CreateCustomVolumeFromBackup` in `internal/server/storage/backend.go` contains an unguarded `*time.Time` dereference on the `ExpiresAt` field of every volume-snapshot…
-
Low 2.1
Incus: Nil-pointer dereference in createDependentVolumesFromBackup on disk.{Volume,VolumeSnapshots,Pool}
Incus is a system container and virtual machine manager. Prior to version 7.1.0, `(*backend).createDependentVolumesFromBackup` in `internal/server/storage/backend.go` contains a cluster of unguarded pointer derefs on every dependent-volume entry's `VolumeSnap…
-
Low 2.7
fluent-plugin-s3: Denial of Service (DoS) via Decompression Bomb in `in_s3`
fluent-plugin-s3 is an Amazon S3 input and output plugin for Fluentd. From 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with…
-
Low 3.8
Kubevirt: virt-handler-rhel9: kubevirt: unbounded virtio-serial readline in virt-handler causes oom denial of service
A flaw was found in KubeVirt's downward metrics virtio-serial server. The server reads guest requests using textproto.Reader.ReadLine(), which buffers input indefinitely until a newline character is received, with no length limit or read deadline. A user with…
-
Low —
fixurjavainstall: Previous Fuji versions can accidentally wipe `/usr/share/man/man8`
### Impact Affects: Anyone who generates the UNIX man pages in Fuji <= `0.8.0` build with the `dev` crate feature. Consequences: `/usr/share/man/man8` may be entirely removed & re-created without any of the previous entries. ### Patches At the time of writing…