CVE-2024-24786

CVE-2024-24786 concerns protojson.Unmarshal entering an infinite loop when unmarshalling certain invalid JSON, notably into messages containing google.protobuf.Any or when UnmarshalOptions.DiscardUnknown is set. Connected advisories show multiple vendor/package records (e.g., kata-containers, mob...

CVE-2023-5002

CVE-2023-5002 affects pgAdmin’s server HTTP API where path validation for external PostgreSQL utilities (e.g., pg_dump/pg_restore) was insufficient. An authenticated user could cause the server to execute arbitrary commands due to improper control of server-side code. Reports across multiple sour...

CVE-2023-1555

GitLab CVE-2023-1555 affects all versions from 15.2 before 16.1.5, 16.2 before 16.2.5, and 16.3 before 16.3.1. The root cause is a namespace-level banned user being able to access the API, enabling unauthorized API access. The issue is documented with fixed versions: 16.1.5, 16.2.5, and 16.3.1 re...

CVE-2023-39965

CVE-2023-39965 affects the 1Panel backend (version 1.4.3) where authenticated users can download arbitrary files through the API interface, causing information leakage. The root cause is unauthorized file access via the API (not requiring high privileges). The issue is addressed in version 1.5.0,...

CVE-2023-34478

Apache Shiro prior to 1.12.0 or 2.0.0-alpha-3 is vulnerable to a path traversal issue that can enable an authentication bypass when used with APIs or web frameworks that route requests based on non-normalized paths. Affected versions include Shiro before 1.12.0 and 2.0.0-alpha-3, with the mitigat...

CVE-2023-32191

The CVE-2023-32191 issue affects Rancher RKE: cluster state is stored in the full-cluster-state configmap in the kube-system namespace, containing sensitive credentials and keys (e.g., SSH keys, cloud provider credentials, encryption keys). This enables non-admin users to escalate to admin. Patch...

CVE-2023-4647

GitLab CVE-2023-4647 affects all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, and all versions starting from 16.3 before 16.3.1, where the projects API pagination can be skipped, potentially causing DoS on affected instances. Root cause: flaw in handli...

CVE-2018-19518

CVE-2018-19518 affects University of Washington IMAP Toolkit (uw-imap) 2007f on UNIX, used by imap_open() in PHP and other apps. The vulnerability arises when imap_rimap (c-client/imap4r1.c) and tcp_aopen (osdep/unix/tcp_unix.c) invoke rsh/ssh with untrusted server input, enabling remote command ...

CVE-2024-27041

CVE-2024-27041 affects the Linux kernel DRM AMD display path. The issue is a NULL-ptr dereference in amdgpu_dm_fini() if adev->dm.dc is NULL before dc_enable_dmub_notifications(). The fix consolidates NULL checks under a single conditional and ensures safe access prior to deinitialization, per...

CVE-2019-9641

CVE-2019-9641 affects PHP's EXIF extension (older PHP 7.1.x/7.2.x/7.3.x branches). Affected versions are PHP 7.1.0–7.1.26/7.2.0–7.2.15/7.3.0–7.3.2 (per sources: 7.1.27, 7.2.16, 7.3.3 as fixed). The root cause is an uninitialized read in exif_process_IFD_in_TIFF (with related notes on exif_process...

CVE-2023-40743

Apache Axis 1.x is affected by CVE-2023-40743 due to unsafe handling in ServiceFactory.getService, which can enable DoS, SSRF, and remote code execution when untrusted input is used. The issue arises from LDAP-like lookups via the API. Mitigation is to migrate to a maintained SOAP engine (e.g., A...

CVE-2023-36458

1Panel is an open source Linux server operation and maintenance panel. Affected versions are

CVE-2023-23684

WPGraphQL

CVE-2023-38492

Kirby CMS is affected by CVE-2023-38492. The vulnerability stems from the authentication endpoint not enforcing password length limits, allowing passwords potentially as long as the server’s max request body. Hashing longer passwords can exhaust CPU/memory, risking a DoS where the site becomes sl...

CVE-2022-22721

CVE-2022-22721 concerns the Apache HTTP Server. On 32-bit systems, if LimitXMLRequestBody is set to allow request bodies larger than 350 MB (default 1 MB), an integer overflow can occur, leading to out-of-bounds writes. Affected product: Apache HTTP Server 2.4.52 and earlier. Impact per sources: ...

CVE-2023-29198

CVE-2023-29198 affects Electron apps that use contextIsolation with contextBridge. The vulnerability is a context isolation bypass that occurs when a main-world exposed API returns an unserializable object (e.g., a canvas rendering context), allowing access from the renderer to the isolated Elect...

CVE-2023-36457

1Panel (open-source Linux server operation/maintenance panel) prior to v1.3.6 is affected by a command injection vulnerability when adding container repositories. An authenticated attacker can craft a malicious payload (as demonstrated by the reported payloads in advisories) to trigger code execu...

CVE-2011-4327

Technical details for CVE-2011-4327 are not publicly available in the provided documents. Monitor for updates from vendors and security advisories.

CVE-2023-20891

The CVE-2023-20891 issue affects VMware Tanzu Application Service for VMs and Isolation Segment. A information-disclosure vulnerability arises from credentials being logged in hex encoding within platform system audit logs. A non-admin user with access to these logs could access hex-encoded CF AP...

CVE-2024-35375

CVE-2024-35375 affects DedeCMS 5.7.114 backend and its mediaadd.php page, where an arbitrary file upload vulnerability exists in the media add functionality. The connected sources do not provide a confirmed fix or patched version. Root cause details are not explicitly described beyond the upload ...

CVE-2024-5910

CVE-2024-5910 affects Palo Alto Networks Expedition (versions prior to 1.2.92). The issue is missing authentication for a critical function, enabling an attacker with network access to potentially takeover an Expedition admin account and exfiltrate configuration secrets and credentials. Public so...

CVE-2022-28831

Adobe InDesign is affected by CVE-2022-28831 (Font Parsing Out-Of-Bounds Write) leading to remote code execution in the context of the current user. Affected versions include 17.1 and earlier, and 16.4.1 and earlier. The vulnerability arises from an out-of-bounds write during font parsing and req...

CVE-2023-4009

Summary: CVE-2023-4009 affects MongoDB Ops Manager. An authenticated user with project owner or project user admin access could generate an API key with the privileges of org owner, enabling privilege escalation. Affected versions: Ops Manager 5.0 prior to 5.0.22 and 6.0 prior to 6.0.17. Impact: ...

CVE-2024-53241

CVE-2024-53241 affects the Linux kernel when running with Xen PV guests. The root cause is an unsafe PV iret hypercall path via the Xen hypercall page. The fix replaces the hypercall-page jump with an inlined sequence in xen-asm.S to stop using the hypercall page, preparing for its removal due to...

CVE-2025-21678

In CVE-2025-21678, Linux kernel gtp: Destroy device along with udp socket’s netns dismantle was fixed. The root cause was gtp_newlink() attaching the device to dev_net(dev) instead of src_net, which meant a UDP tunnel socket created in a different netns could leave the device alive in dev_net(dev...

CVE-2023-38949

CVE-2023-38949 affects ZKTeco BioTime v8.5.5 via a hidden API in the web interface that can be abused by unauthenticated attackers to reset the Administrator password through a crafted request. The root cause is an exposed, unauthenticated password-reset pathway in the BioTime web platform; impac...

CVE-2023-3709

The CVE-2023-3709 vulnerability affects the WordPress plugin Royal Elementor Addons, with affected versions up to and including 1.3.70. The issue allows unauthenticated disclosure of a site’s MailChimp API key because the plugin writes the API key into the source code of pages that render the Mai...

CVE-2024-27516

CVE-2024-27516 affects livehelperchat prior to version 4.34. The SSTI exists in the search parameter of lhc_web/modules/lhfaq/faqweight.php, enabling remote code execution and access to sensitive data. Impact is high (as per sources) including arbitrary code execution and data disclosure. Recomme...

CVE-2023-26143

CVE-2023-26143 affects the blamer package prior to version 1.0.4. The root cause is an Arbitrary Argument Injection via the blameByFile() API due to insufficient input sanitization and invalid file-path handling, coupled with improper passing of git flags ( -- ) to terminate options. Public analy...

CVE-2025-21664

CVE-2025-21664 affects the Linux kernel dm-thin component. Root cause: get_first_thin did a non-RCU-safe sequence (list_empty -> list_first) that could race with concurrent updates, risking dereferencing a stale/altered list head during process_deferred_bios flow and leading to a crash. Connec...

CVE-2025-21653

CVE-2025-21653 affects the Linux kernel net_sched flow classifier (net/sched/cls_flow.c). The vulnerability was due to missing validation of TCA_FLOW_RSHIFT, which could trigger undefined behavior (UB) and a shift-out-of-bounds on large 32-bit shifts, as shown by UBSAN. Connected advisories (Astr...

CVE-2024-56570

CVE-2024-56570 – Linux kernel ovl (overlayfs) : The vulnerability arises in the ovl module where directory inodes that lack the lookup function could be processed, potentially triggering errors in overlayfs when passed to the lowerstack. The fix adds a check in ovl_dentry_weird() to filter/skip i...

CVE-2023-33831

CVE-2023-33831 affects FUXA 1.1.13 via the unauthenticated /api/runscript endpoint, enabling remote code execution through a crafted POST request. The underlying issue allows attackers to execute arbitrary commands, potentially compromising the SCADA/HMI system. Affected component: runscript API ...

CVE-2024-2961

CVE-2024-2961 affects the GNU C Library (glibc) versions 2.39 and older. The iconv() implementation may overflow the output buffer by up to 4 bytes when converting strings to ISO-2022-CN-EXT, potentially crashing the application or overwriting adjacent memory. Publicly documented in glibc advisor...

CVE-2019-1414

CVE-2019-1414 affects Visual Studio Code. A local elevation-of-privilege vulnerability arises when VS Code exposes a debug listener/port to the local user, allowing code injection in the user context. Affected versions are generally prior to 1.39.1; remediation is to update VS Code to 1.39.1 or l...

CVE-2023-42118

CVE-2023-42118 affects Exim libspf2. The vulnerability arises in the SPF macro parser, where unvalidated user-supplied data can trigger an integer underflow before memory write, enabling remote code execution with the service account context. Exploitation appears feasible by network-adjacent atta...

CVE-2023-41324

GLPI (Gestionnaire Libre de Parc Informatique) vulnerability CVE-2023-41324 is evidenced in connected records as a SQL injection flaw in GLPI’s search functionality. Affected are GLPI versions prior to 10.0.13 (per PT Security entries); authenticated users can exploit the flaw to access or extrac...

CVE-2023-28001

CVE-2023-28001 affects Fortinet FortiOS FortiOS REST API. The issue is an insufficient session expiration that could allow an attacker to reuse the session of a deleted user to execute unauthorized code/commands. Connected sources confirm the vulnerability and note Fortinet/FortiGuard PSIRT advis...

CVE-2023-35942

CVE-2023-35942 affects Envoy. Prior to fixes, gRPC access loggers using a listener’s global scope can cause a use-after-free crash when the listener is drained. Affected versions: < 1.23.12, < 1.24.10, < 1.25.9, < 1.26.4,

CVE-2023-3345

CVE-2023-3345 affects the LMS by Masteriyo WordPress plugin prior to 1.6.8. The plugin’s REST API endpoints lack proper authorization, enabling any student to retrieve other students’ email addresses (information disclosure). Root cause per connected details: insufficient access checks on REST ro...

CVE-2026-35414

OpenSSH CVE-2026-35414 affects OpenSSH before 10.3, where the authorized_keys principals option can be mishandled when a CA uses comma characters in a multi-principal scenario. Multiple connected advisories (IBM AIX advisory, Debian DLA, AlmaLinux/Almalinux, CloudLinux, and Amazon Linux ALAS entr...

CVE-2022-37436

CVE-2022-37436 affects Apache HTTP Server in versions prior to 2.4.55. The issue allows a malicious backend to truncate response headers early, causing some headers to be incorporated into the response body and preventing the later headers from being interpreted by the client. Affected products i...

CVE-2022-48669

CVE-2022-48669 : In the Linux kernel, the powerpc/pseries path had a memleak in papr_get_attr() where a krealloc() could fail and the original buffer would not be freed. The fix ensures the original buf is freed on allocation failure. Affected: Linux kernel (powerpc/pseries implementation); Root ...

CVE-2023-42328

PeppermintLabs Peppermint v0.2.4 and earlier are affected by a vulnerability where a hardcoded session cookie allows a remote attacker to obtain sensitive information and execute arbitrary code. Root cause: hardcoded session cookie in Peppermint; impact is high (CVE-2023-42328, CVSS v3.1: AV:N/AC...

CVE-2023-39964

Summary: CVE-2023-39964 affects 1Panel O&M panel. In version 1.4.3, the function LoadFromFile in api/v1/file.go reads a server file directly from the unfiltered path parameter, enabling arbitrary file reads of important configuration files. The issue is a background file read vulnerability exploi...

CVE-2023-42457

The CVE-2023-42457 issue affects the plone.rest component of Plone. When the ++api++ traverser is accidentally used multiple times in a URL on the 2.x branch (before 2.0.1) and the 3.x branch (before 3.0.1), request handling becomes progressively slower, causing a Denial of Service risk by reduci...

CVE-2023-40029

Argo CD CVE-2023-40029 exploits leakage of full cluster secret bodies via kubectl.kubernetes.io/last-applied-configuration in cluster secrets. Affected by PR #7139; exposure occurs when clusters are stored as secrets and viewed through the API with clusters, get RBAC. Patches available in 2.8.3, ...

CVE-2025-21702

The CVE CVE-2025-21702 concerns a bug in Linux kernel pfifo_tail_enqueue where, when sch->limit == 0, a path can cause qlen to be increased to one even if a preceding drop would have kept it at zero. This leads to a mismatch where a parent qlen no longer equals the sum of its children’s qlen, ...

CVE-2023-39239

The CVE-2023-39239 entry concerns an authenticated/remote (sources vary on privilege) format string vulnerability in the General function API (apply.cgi) of ASUS RT-AX56U V2. The flaw arises from lack of input validation for a specific value in apply.cgi, enabling remote code execution or disrupt...

CVE-2023-20230

CVE-2023-20230 affects Cisco Application Policy Infrastructure Controller (APIC). The issue arises from improper access control in the restricted security domain implementation used to enforce multi-tenancy, allowing an authenticated, remote attacker with a restricted-domain account to read, modi...