38,600 results · Feed
-
Critical 9.8CVE-2026-105192 Public exploit
LMCache Unauthenticated RCE in multiprocess mode via pickle deserialization
LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. Messages on that socket are msgpack. Extension code 1 is passed to DeviceIPCWrapper.Deserialize, which …
-
High 8.2
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes valid…
-
Medium 6.5
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
Wasmtime is a runtime for WebAssembly. Prior to 24.0.11, 36.0.12, 45.0.3, and 46.0.1, wasmtime-wasi hard-link creation and renaming check directory permissions but not matching FilePerms on source and destination preopens, allowing a WASI guest with a read-on…
-
High 7.5
lopdf has a stack overflow via deeply nested PDF objects
`lopdf::Document::load_mem` (and the other `load*` entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (`/X [[[ … ]]]`, on the order of 10,000 levels) exhausts the …
-
High 7.5
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG res…
-
Critical 9.2
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config fla…
-
Low 3.7
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless…
-
Low 3.1
CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a…
-
Low 3.3
ClickMigrate has Path Traversal in "revision -m" argument
ClickMigrate is a database migration tool for ClickHouse with automatic SQL migration management and version tracking. Prior to version 1.0.3, a path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument…
-
High 7.5
gomarkdown/markdown IsSafeURL panics on short URLs
The package github.com/gomarkdown/markdown is a Go library for parsing Markdown text and rendering as HTML. Prior to 0.0.0-20260724235538-61af6e1e6971, parser.IsSafeURL in parser/parser.go slices url[:nPath] before the len(url) >= nPath guard. A short destina…
-
Unscored —
WebAssembly allocator shim corrupts memory on allocation failure
On wasm32, zstd-sys provides `malloc` and `free` to the C library through a shim over Rust's allocator. The shim did not check for allocation failure: it wrote its size header to address 0 and returned address 4, which the C library used as a valid buffer. `f…
-
Unscored —
Use-after-free when changing a multithreaded context with an unfinished frame
When a multithreaded frame (`zstdmt` feature, `CParameter::NbWorkers`) is left unfinished, its jobs may still be running on the worker threads: the C library only waits for them when the next frame starts, or when the context is freed. A session reset makes t…
-
Unscored —
Out-of-bounds read with an out-of-range `InBuffer::pos`
`InBuffer`'s fields are public, so safe code can set `pos` past the end of `src`. The position was passed to the C library unchecked, and `ZSTD_seekable_compressStream`, unlike the other streaming functions, does not validate it: it read past the end of the i…
-
Unscored —
Double free in `DCtx::try_clone`
`DCtx::try_clone` (`experimental` feature, deprecated) is a plain copy of the C context. A context owning a dictionary (from `load_dictionary`, `ref_prefix` or `init_using_dict`) or a dictionary table (`ref_ddict` with `RefMultipleDDicts`) ended up with both …
-
Unscored —
Uninitialized memory exposed when streaming decompression of a legacy frame fails
When decompression fails inside a legacy (zstd v0.4 to v0.7) frame, the bundled zstd library reports the output buffer as fully written although nothing was written. `DCtx::decompress_stream` committed that position even on error, and for a `Vec<u8>` destinat…
-
Unscored —
Heap buffer overflow in `CCtx::try_clone` on a multithreaded context
`CCtx::try_clone` (`experimental` feature, deprecated) copies tables sized from the context's applied parameters. Starting a multithreaded frame (`zstdmt` feature) replaces those parameters with the workers' without resizing the context's own tables, so after…
-
Unscored —
Out-of-bounds read in `train_from_buffer` when sample sizes overflow
`ZDICT_trainFromBuffer` is never told the length of the samples buffer, so `train_from_buffer` checked that the sample sizes add up to it. With overflow checks off, as in release builds, that sum wrapped around: sizes totalling 2^64 plus the buffer length pas…
-
Unscored —
Use-after-free of a dictionary after a one-shot call on a context with an open stream
The one-shot `DCtx` and `CCtx` methods assumed the C library resets the context, but it leaves an open stream as it is. When a stream was left unfinished on a context, a one-shot call such as `decompress_using_dict` could leave the context pointing at the dic…
-
Unscored —
Use-after-free through `init_using_cdict` and `init_using_ddict`
`CCtx::init_using_cdict` and `DCtx::init_using_ddict` (`experimental` feature, deprecated) took the dictionary as `&CDict<'b>` and `&DDict<'b>` with only `'b: 'a`, so the dictionary itself could be dropped while the context still pointed at it. The same mista…
-
Unscored —
`Seekable::decompress` sets a `Vec` length beyond its capacity for offsets past the end
`ZSTD_seekable_decompress` shortens the requested length to the end of the data without checking that the offset is before it. For an offset past the end, it returns a wrapped-around length without writing anything, and `Seekable::decompress` passed that leng…
-
Unscored —
`OutBuffer::around_pos` exposes uninitialized memory
`OutBuffer::around_pos` accepted a position past the initialized length of a `Vec<u8>`. The next streaming call then marked everything before the position as initialized, so safe code could read stale heap memory between the vector's previous length and that …
-
Unscored —
`Seekable` reads a NULL or out-of-bounds seek table
`Seekable` did not record whether it was initialized. On a fresh `Seekable`, or one whose `init_buff()` failed, `decompress`, `offset_to_frame_index` and `frame_decompressed_size` made the C library read a NULL seek table. After a failed re-initialization, `d…
-
Unscored —
Use-after-free with `CParameter::StableInBuffer`
With `CParameter::StableInBuffer(true)` (`experimental` feature), the C library keeps a pointer to the input of one streaming call and reads from it in later calls, including `flush_stream` and `end_stream`, which take no input. An `InBuffer` only borrows its…
-
Unscored —
Out-of-bounds read when training a dictionary from inconsistent sample sizes
`ZDICT_trainFromBuffer` is never told the length of the samples buffer. Before 0.4.10, `zstd::dict::from_continuous` (initially `train_dict`) called it directly: up to 0.2.1 without checking the sample sizes against the buffer at all, and from 0.3.0 with a su…
-
Unscored —
Uninitialized memory exposed by `write::Decoder` on a corrupt legacy frame
From 0.4.22 to 0.7.x, the writer behind `zstd::stream::write::Decoder` set its output buffer's length to its full capacity before each decompression call, then to the position the call reported, and only checked for an error afterwards. When decompression fai…
-
Unscored —
Data from an abandoned stream leaks into the next stream on a reused context
The `with_context` constructors of the stream encoders and decoders used the borrowed context as it was. When a stream was abandoned on a context, for example an encoder dropped before `finish()` after an error, whatever it left there was carried into the nex…
-
Unscored —
Missing case-insensitive matching for CSS url function
URL filtering, such as relative URLs and URL scheme limits, is not always applied when CSS sanitization is used. When the inner URL is quoted, CSS `url("")` is matched case-sensitively, when it should be matched case-insensitively. As a result, while `url("")…
-
Unscored —
`zvariant_derive` is unmaintained
The `zvariant_derive` crate is no longer maintained as a standalone crate. Its derive macros are provided by [`zbus`](https://crates.io/crates/zbus) starting with version `6.0.0`. Users should migrate to [`zbus`](https://crates.io/crates/zbus), with its defau…
-
Unscored —
`zbus_names` is unmaintained
The `zbus_names` crate is no longer maintained as a standalone crate. It has been merged into [`zbus`](https://crates.io/crates/zbus) starting with version `6.0.0`, as its `names` module. Users should migrate to [`zbus`](https://crates.io/crates/zbus), with i…
-
Unscored —
`zvariant` is unmaintained
The `zvariant` crate is no longer maintained as a standalone crate. It has been merged into [`zbus`](https://crates.io/crates/zbus) starting with version `6.0.0`, as its `wire` module. Users should migrate to [`zbus`](https://crates.io/crates/zbus), with its …
-
Low 3.3
Stack overflow when parsing deeply nested input in pest_grammars
## Impact In affected versions, parsing deeply nested input with `pest_grammars::json::JsonParser` can exhaust the native stack and abort the hosting process. Applications that accept attacker-controlled JSON without suitable resource limits may therefore be …
-
Critical 9.3
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web. From 1.143.12 until 1.169.39 for @tanstack/start-server-core, 1.168.60 for @tanstack/react-start, 1.168.57 for @tanstack/solid-start, and 1.168.56 …
-
Medium 5.6
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-…
-
Critical 10.0
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation res…
-
Medium 4.2
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.7 until 4.5.11 and 4.6.4, the markdownviewer:trust and notebook:trust command-link handlers use tracker.currentWidget to r…
-
Medium 4.3
SFTPGo source-side file-pattern filter bypass during copy operations
SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern …
-
High 7.5
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
Claude Code is an agentic coding tool. Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker wh…
-
Medium 4.6
containerd: Unpack DoS via repeated opaque whiteouts
containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory tr…
-
Medium 6.8
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.2, registry/client.(*manifests).Get() reads a manifest returned for a digest-pinned request and passes it to distribution.UnmarshalManifest without hashing the body ag…
-
High 8.7
Qwik: Crashing any Qwik Server via Resource thenable
Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side qwik-json deserialization causes ResourceSerializer.$fill$ to pass resource._resolved to Promise.resolve without first r…