Reserved but Public CVEs

SwiftNIO contains an out-of-bounds memory corruption vulnerability in ByteBuffer index and length handling. According to the provided advisory, affected helper functions perform unsafe UInt32(truncatingIfNeeded:) conversions on attacker-influenced index, offset, or length values. When values larger than UInt32.max are supplied, truncation can wrap the value and cause incorrect buffer position or size calculations, leading to out-of-bounds writes or reads and corruption of buffer contents or outbound packets.

CVE-2026-43671First seen Jun 13, 2026

CVE-2014-5244 is a denial-of-service vulnerability in the Symfony HttpFoundation component. The issue is triggered when Request::getHost() performs hostname validation on a maliciously long HTTP Host header. Processing an arbitrarily long hostname causes excessive computation during validation, allowing an attacker to consume application resources with crafted requests. The affected branches include Symfony HttpFoundation / Symfony 2.0.x, 2.1.x, 2.2.x, and vulnerable releases prior to the fixed versions in the maintained branches.

CVE-2014-5244First seen Jun 4, 2026

FluxCD source-controller contains improper path handling that allows path traversal outside the per-reconciliation working directory. According to the advisory, if an attacker can influence the contents of a bucket referenced by a Bucket resource, source-controller may write fetched object data to filesystem paths outside the intended working directory, subject to the filesystem permissions of the source-controller pod. In addition, in source-controller v1.6.0 and later, a user able to create or update GitRepository resources can abuse sparse-checkout style path handling to trigger existence checks for paths outside the cloned repository and infer limited file path information through resource status.

CVE-2026-47680First seen Jun 6, 2026

SwiftNIO contains a CRLF injection vulnerability in outbound HTTP/1.1 request and response start line components caused by insufficient validation in NIOHTTPRequestHeadersValidator and NIOHTTPResponseHeadersValidator. According to the provided advisory, validation was missing or inadequate for request URIs, custom HTTP methods, and response reason phrases, allowing attacker-controlled carriage return and line feed characters to be injected into HTTP/1.1 start lines. This can corrupt HTTP message framing and enable downstream protocol interpretation issues.

CVE-2026-28970First seen Jun 13, 2026

CVE-2025-30081 is a cross-site scripting (XSS) vulnerability in the Clickstorm SEO extension for TYPO3. According to the provided advisory, the flaw allows a logged-in TYPO3 backend user to inject improperly encoded input into HTML output rendered in the TYPO3 backend. The issue stems from insufficient output encoding of user-controlled input before it is included in backend HTML, enabling script-capable content to be executed in another user's browser within the backend context.

CVE-2025-30081First seen Jun 4, 2026

SwiftNIO's NIOHTTP1 HTTPDecoder accepts unbounded HTTP/1 header blocks. When processing HTTP/1 requests or responses, the decoder can accumulate header data without sufficient limits, allowing a remote peer to send excessively large or numerous headers. This can exhaust memory in applications using NIOHTTP1 and, in some downstream frameworks, may also trigger a process crash when framework-level header count limits are exceeded after the decoder has already accumulated the data.

CVE-2026-28980First seen Jun 13, 2026

CVE-2026-28975 affects swift-nio-extras in the NIOHTTPRequestDecompressor component. When decompression protection is configured using the .ratio(N) limit, the implementation can be bypassed by an attacker supplying a falsified inflated Content-Length header. The vulnerable logic relies on the header-supplied Content-Length value when enforcing the decompression ratio limit, rather than tracking the actual compressed bytes received. As a result, a highly compressed request body can be accepted and decompressed without the intended protection being applied.

CVE-2026-28975First seen Jun 13, 2026

A configuration-validation flaw in the Radius Kubernetes controller allows a tampered Deployment annotation, radapp.io/status, to reference a container resource outside the current tenant or namespace. When the controller processes the manipulated annotation, it can issue deletion of the referenced Radius-managed container resource without properly validating tenant or namespace ownership. In multi-tenant Radius installations, this creates a cross-tenant authorization failure where one tenant's Deployment metadata can influence deletion of another tenant's resource. The issue is described as affecting deletion logic tied to controller handling of annotated Deployment state.

CVE-2026-53999First seen Jun 13, 2026

Bugsink contains a denial-of-service vulnerability in its event ingestion path. According to the provided advisory, an attacker can submit an event containing an unusually large number of attacker-controlled custom tags. Because Bugsink uses a single-writer database architecture, storing these excessive tags triggers expensive write transactions that can delay processing of other events. The issue is therefore caused by insufficient restriction of resource consumption during event-tag storage for a single ingested event.

CVE-2026-53954First seen Jun 13, 2026

Omni improperly exposes ImportedClusterSecrets resources for imported Talos/Kubernetes clusters to authenticated users with Reader-level access. As described in the advisory, this allows retrieval of sensitive imported cluster secret material, including cluster certificate authority assets associated with Kubernetes, etcd, Talos, and service accounts. The issue affects imported clusters whose secrets have not been rotated, and results in disclosure of full cluster CA key material outside the intended trust boundary.

CVE-2026-45726First seen Jun 6, 2026

CVE-2023-32198 is an improper certificate validation vulnerability in Steve. During TLS connections, Steve does not verify the remote server certificate by default, contrary to expected Go TLS certificate validation behavior. This allows a malicious intermediary to present an untrusted or spoofed certificate without being rejected, enabling interception and modification of traffic between Steve and the remote service. In Rancher deployments, the issue is particularly relevant under specific configuration conditions involving remote UI content retrieval.

CVE-2023-32198First seen Jun 4, 2026

CVE-2025-30083 is a cross-site scripting vulnerability in the codingms/additional-tca extension for TYPO3. According to the provided advisory, improperly encoded user input can be used by an authenticated TYPO3 backend user to create malicious output in an HTML context within the TYPO3 backend. The issue is therefore an authenticated backend-context XSS caused by insufficient output encoding of user-controlled data.

CVE-2025-30083First seen Jun 4, 2026

CVE-2026-45720 is a time-of-check time-of-use (TOCTOU) race condition in Omni's SAML.getSession logic. The flaw allows a nominally single-use SAML session token (saml-session) to be accepted multiple times when concurrent requests race the token-consumption logic. As a result, a stolen valid saml-session token can be replayed in parallel to create multiple authenticated sessions under the victim's identity, defeating the intended single-use property of the token.

CVE-2026-45720First seen Jun 6, 2026

CVE-2015-2309 affects the Symfony HttpFoundation Request class. When at least one trusted proxy is configured, unsafe request-handling methods can incorrectly trust client-supplied HTTP header values. As a result, header-derived properties exposed by methods such as getPort(), isSecure(), getHost(), and getClientIps() may be influenced by attacker-controlled input rather than only by values inserted by trusted infrastructure. The issue is specifically tied to proxy trust handling in deployments that rely on forwarded headers to reconstruct the original client request context.

CVE-2015-2309First seen Jun 4, 2026

CVE-2026-47215 is an incorrect path matching vulnerability in SingularityCE and SingularityPRO affecting the `limit container paths` directive. When administrators configure this directive to restrict where containers may be executed from, the path validation logic can incorrectly match similarly named sibling directories. As a result, a container stored in an unintended sibling path with a similar prefix or name can be treated as if it were within an authorized location. The issue is specifically described as affecting path restriction enforcement rather than container image integrity itself.

CVE-2026-47215First seen Jun 5, 2026

CVE-2014-4931 is a code injection vulnerability in Symfony FrameworkBundle's translation caching mechanism. According to the provided advisory context, attacker-controlled locale values, such as unsanitized _locale parameters supplied via URLs, can be written into generated cache files. If those locale values are not properly sanitized before reaching the translation caching logic, an attacker can inject arbitrary PHP code into the cache content, which may then be executed by the application.

CVE-2014-4931First seen Jun 4, 2026

CVE-2013-7035 is a cross-site scripting vulnerability in React affecting 0.5.x before 0.5.2 and 0.4.x before 0.4.2. According to the provided advisory, the issue is caused by improper sanitization of input used to create keys. If an application derives a React key from attacker-controlled input, the unsanitized value can be incorporated in a way that enables script execution in the victim's browser context.

CVE-2013-7035First seen Jun 4, 2026

CVE-2026-47701 affects the OpenTelemetry Operator for Kubernetes. The TargetAllocator component improperly preserves Prometheus Operator ServiceMonitor file-based authentication and TLS settings into generated Prometheus scrape configuration. Specifically, unsafe fields such as bearerTokenFile and related tlsConfig file path options (including caFile, certFile, and keyFile) can be propagated into the OpenTelemetry Collector scrape configuration instead of being rejected or sanitized. If an attacker can create or modify a ServiceMonitor that is selected by the TargetAllocator configuration, they can point these settings at arbitrary files on the Collector pod filesystem. During scraping, the Collector will read those local files and use their contents in outbound requests to the configured scrape target, allowing exfiltration of sensitive local files. Exposed material can include the mounted Kubernetes service account token, certificates, private keys, and other tokens present in the pod.

CVE-2026-47701First seen Jun 11, 2026

CVE-2014-6061 is an authentication-related flaw in the Symfony HttpFoundation component affecting applications that rely on HTTP Basic or Digest authentication. The vulnerability stems from improper parsing of the HTTP Authorization header by HttpFoundation in certain server configurations. As a result, authentication handling may be performed incorrectly when the framework processes malformed or ambiguously parsed Authorization header data. Based on the provided advisory, the issue was fixed in Symfony versions 2.3.19, 2.4.9, and 2.5.4, with a corresponding patch published in Symfony pull request #11829.

CVE-2014-6061First seen Jun 4, 2026

CVE-2024-22031 is a privilege escalation vulnerability in Rancher caused by improper handling of project identity across clusters when projects share the same object name. According to the provided advisory, a user with permission to create projects on one cluster can create a project using the same name as an existing project in another cluster and thereby gain access to the other project. The issue appears to stem from namespace or object-name collision behavior across clusters, allowing authorization boundaries between clusters to be bypassed when duplicate project names exist.

CVE-2024-22031First seen Jun 4, 2026

In doorkeeper-openid_connect, Dynamic Client Registration can create applications as public clients while still returning a client_secret to the registrant. As a result, the token endpoint may accept authentication using only the public client_id for those dynamically registered clients, rather than requiring a valid client_secret as expected for confidential clients. This creates an authentication weakness in deployments using the OpenID Connect Dynamic Client Registration feature.

CVE-2026-44476First seen Jun 5, 2026

Symfony HttpKernel contains an access control flaw affecting deployments where Edge Side Includes (ESI) support is enabled behind a trusted proxy. In affected versions, clients can directly request fragment/ESI URLs, such as the fragment endpoint, instead of having those requests mediated exclusively by the trusted proxy as intended. This can expose protected fragment endpoints or allow invocation of internal fragment functionality that should only be reachable through proxy-driven fragment rendering.

CVE-2014-5245First seen Jun 4, 2026

free5GC UDR contains an improper input validation vulnerability in its EE subscription handling logic. Specifically, the ueId validation performed in HandleCreateEeSubscriptions and HandleQueryeesubscriptions is overly permissive due to a trailing regex branch ('|.+') that accepts any non-empty string. As a result, arbitrary non-3GPP ueId values can be accepted by the UDR SBI endpoint, persisted to storage, and later retrieved. This breaks the expected constraint that stored identifiers conform to supported 3GPP SUPI/GPSI-style formats and can corrupt the integrity of identifier namespaces relied upon by other components.

CVE-2026-47780First seen Jun 12, 2026

CVE-2023-50462 is an insecure direct object reference (IDOR) vulnerability in the TYPO3 Content Consent extension (Packagist package t3s/content-consent). The flaw allows unauthenticated users to retrieve and display content elements by referencing content element identifiers without proper authorization checks. Based on the available advisory, access control on object references is insufficient, enabling direct access to internal content elements that should not be exposed.

CVE-2023-50462First seen Jun 4, 2026

CVE-2023-50461 is a configuration injection vulnerability in the TYPO3 Direct Mail extension (direct_mail). An authenticated backend user with access to the Direct Mail Configuration backend module can write arbitrary page TSConfig for folders configured as Direct Mail. The issue affects the directmailteam/direct-mail package and enables unauthorized modification of TYPO3 page TSConfig associated with Direct Mail folders. Based on the provided advisory, the flaw results in configuration injection on TYPO3 10.4 and later, while on TYPO3 9.5 and earlier the injected configuration can lead to arbitrary code execution.

CVE-2023-50461First seen Jun 4, 2026