C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a buffer overflow vulnerability in the tn_snenv() function. This flaw allows malicious Telnet servers to corrupt client memory by sending crafted NEW-ENVIRON SEND subnegotiation messages with oversized variable names before authentication. The vulnerability involves overflowing a 16-byte stack buffer and a miscalculated heap buffer, leading to stack and heap memory corruption. A fix is available in version 11.1.515.
C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.
C-Kermit versions before 11.1.515 contain a critical OS command injection vulnerability. Remote clients can exploit this flaw by supplying unquoted arguments to the REMOTE WHO or REMOTE SPACE commands, allowing execution of arbitrary shell commands on the server. This occurs even if the DISABLE HOST setting is enabled. The vulnerability is fixed in version 11.1.515.
C-Kermit versions from 6.0.192 up to but not including 11.1.515 contain a critical remote code execution vulnerability. This flaw allows attackers to execute shell commands on servers even when host commands are disabled by abusing REMOTE QUERY evaluation. The vulnerability can be exploited by sending a REMOTE QUERY that invokes the command function or by defining and executing a macro via REMOTE ASSIGN, bypassing restrictions such as nopush and DISABLE HOST. A fix is available in version 11.1.515.
C-Kermit versions before 11.1.515 contain a heap-based buffer overflow vulnerability in the putsrv() function within ckcfns.c. This flaw allows malicious peers to write beyond the allocated srvcmd buffer by sending specially crafted packets using Kermit repeat-count compression. The vulnerability affects server commands, GET, or file-header packets, potentially leading to memory corruption on servers or receiving instances. A fix is available in version 11.1.515.
SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in sys_user.password as unsalted MD5 digests via md5pwd() in security.py. Attackers who obtain the user table can recover passwords, including administrator passwords, using precomputed tables or GPU cracking, since identical passwords produce identical hashes.
CVE-2026-129128 is a local code execution vulnerability in Goose CLI versions 1.35.0 up to but not including 1.53.0. The flaw allows attackers to execute arbitrary OS commands by setting the diff.external configuration in a repository's .git/config file. When a user runs 'goose review' on a crafted repository, the tool executes 'git diff' without the --no-ext-diff option, enabling command execution as the user and potentially exposing credentials and API keys.
AiSOC versions 12.1.0 up to but not including 23.3.0 have a missing authentication vulnerability that allows unauthenticated attackers to query the enrichment service via specific API routes. This flaw enables attackers to retrieve threat intelligence data and potentially consume commercial API quota by setting a force parameter.
A local file disclosure vulnerability exists in callstack's agent-device versions 0.21.36 before 0.21.37. Authenticated remote users can exploit this flaw by sending an open command with a file:// URL through the /rpc interface, then issuing a snapshot command to read plaintext files accessible by the daemon account. This vulnerability allows unauthorized reading of files on the host system.
Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.
MRBS versions before 1.13.0 have an LDAP injection vulnerability in the AuthLdap.php file. This flaw allows attackers with valid directory credentials but outside the required group to bypass access restrictions by submitting crafted usernames that manipulate LDAP group-membership filters. The vulnerability is fixed in version 1.13.0.
CVE-2026-129133 is a CSV formula injection vulnerability in meeting-room-booking-system (mrbs-code) versions before 1.13.0. Authenticated users can inject spreadsheet formulas into booking names, descriptions, or custom fields. These formulas execute when privileged users open exported CSV reports, potentially enabling data exfiltration or command execution via DDE. The vulnerability is fixed in version 1.13.0.
MRBS versions before 1.13.0 have a password reset poisoning vulnerability. This flaw allows unauthenticated attackers to manipulate the Host header when the $url_base setting is unset, causing password reset emails to contain links pointing to attacker-controlled hosts. By requesting a password reset for a victim, attackers can intercept the reset key and potentially take over user accounts, including administrators. The vulnerability is fixed in version 1.13.0.
picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame() that allows remote QUIC peers to corrupt stored timestamps by sending oversized TIME_STAMP values. Attackers on connections negotiating the TIME_STAMP extension can send large values shifted by ack_delay_exponent to wrap the result, corrupting RTT and bandwidth estimation and degrading congestion control.
The casamare npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious components, as the attacker may have gained full control of the system.
Allocation of Resources Without Limits or Throttling vulnerability in elixir-grpc grpc_server allows unauthenticated attackers to exhaust server memory via client-streaming or bidirectional-streaming requests.
The streaming read clause of GRPC.Server.Adapters.Cowboy.Handler.info/3 (grpc_server/lib/grpc/server/adapters/cowboy/handler.ex) asks Cowboy for up to 8,000,000 bytes per read and compares the running total with max_body_size only after the read returns. The gRPC length prefix of a message is not checked before the message is buffered. Each stream can therefore buffer up to one full read beyond the configured limit before it is refused, and many concurrent streams exhaust node memory. Releases before 1.0.6 apply no limit to streaming requests at all.
This issue affects grpc_server: from 1.0.0 before 1.1.0.
Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in elixir-grpc grpc_server and grpc allows unauthenticated attackers to occupy a BEAM scheduler indefinitely via a client-streaming or bidirectional-streaming request whose body ends inside a gRPC message.
GRPC.Server.Adapters.Cowboy.read_stream/1 (grpc_server/lib/grpc/server/adapters/cowboy.ex, and the Cowboy adapter in grpc before the package split) asks for more data whenever the buffer does not hold a complete message. Once the request body has ended, every further read returns an empty chunk, so the buffer never changes and the function retries without end. A single 5-byte length prefix sent with END_STREAM keeps one scheduler busy for as long as the connection stays open, and repeated requests exhaust all schedulers.
This issue affects grpc_server: from 1.0.0 before 1.1.0; grpc: from 0.3.1 before 1.0.0.
The npm package hxqrtv-bznwkp-util contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
A vulnerability in the BACnet Stack library prior to versions 1.4.5, 1.5.1, and 1.6.0 allows a malformed but non-empty BACnet WriteProperty request to cause an infinite processing loop. This leads to uncontrolled resource consumption and a denial of service condition on the official server demo. The issue has been addressed in the specified fixed versions.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, a remote out-of-bounds read exists in the official BACnet client application apps/readpropm in bacnet-stack commit e2bdbf6. When readpropm sends a legitimate ReadPropertyMultiple request to a malicious BACnet/IP peer, the peer can reply with a malformed but structurally valid ReadPropertyMultiple-ACK that drives the client into a global-buffer-overflow read on the global receive buffer Rx_Buf. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.