12,373 results · Clear filters · Feed
-
Low 3.7
flatcc through 0.6.4 Out-of-Bounds Read via __flatcc_json_parser_number
flatcc through 0.6.4 contains an out-of-bounds read vulnerability in __flatcc_json_parser_number that allows attackers to read past the input buffer via numbers ending in a decimal point. Attackers can supply untrusted JSON ending immediately after a decimal …
-
Low 3.7
flatcc through 0.6.4 Out-of-Bounds Read via verifier check_header
flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflow guard is dead code. On 32-bit builds, attackers can supply a crafted buffer offset that wraps the bounds check, causi…
-
Low 3.3
libfvde through 20260923 Heap Out-of-Bounds Read via libfvde_encrypted_metadata_read_type_0x001a
libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plis…
-
Low 3.3
gbsplay through 0.0.103 Heap Out-of-Bounds Read via vgm_open in gbs.c
gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buf…
-
Low 3.3
gbsplay through 0.0.103 Heap Out-of-Bounds Read via gbr_open GBR Title
Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buff…
-
Low 3.3
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27…
-
Low 3.3
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.…
-
Low 3.3
This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia …
-
Low 3.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Low 3.3
This issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2,…
-
Low 3.3
An uninitialized memory issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS…
-
Low 3.3
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Golden Gate 27, macOS Sequoia …
-
Low 3.3
A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27.2, …
-
Low 3.3
An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Golden Gate …
-
Low 3.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Low 3.3
This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27.2, macOS Tahoe 26.7.2. An ap…
-
Low 3.3
An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPa…
-
Low 3.3
An uninitialized memory issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS…
-
Low 3.3
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Low 3.1
A race condition was addressed with improved locking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2,…
-
Low 3.3
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27.2, macOS Se…
-
Low 3.3
A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in iOS 26.7.2 and i…
-
Low 2.1
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placement…
-
Low 2.1
Infinite loop in Xpdf due to missing validation in JPEG 2000 decoder
Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.
-
Low 3.5
subhajitkhan online-clinic-management-system patientregistration.php cross site scripting
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is an unknown function of the file patientregistration.php. Such manipulation of the argument pat_name leads to cross site …
-
Low 2.3
Asterisk: Reflected XSS in Phone Provisioning HTTP Error Pages
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in `phone provisio…
-
Low 3.7
WordPress Photo Reviews for WooCommerce plugin <= 1.2.31 - Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Leveraging Race Conditions.This issue affects Photo Reviews for WooCommerce: from n/…
-
Low 3.4
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an…
-
Low 3.5
Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting
A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /edit_profile of the component Profile. The manipulation of the argument first_name/last_name leads to cross …
-
Low 3.8
Routinator stores TA certificate in cache without validation
Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.
-
Low 3.7
Cross-session AES key confusion in the Espressif ESP32 hardware crypto driver
The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to CONFIG_ESP32_CRYPTO_AES_SESSIONS_MAX (default 4) independent sessions, each carrying its own key and direction. The AES peripheral, however, …
-
Low 3.7
IPv6 stable and temporary interface identifiers derived from a non-cryptographic PRNG secret key
The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers (gen_stable_iid() in subsys/net/ip/ipv6.c) and RFC 8981 temporary interface identifiers (gen_temporary_iid() in subsys/net/ip/ipv6_pe.c) with sys_rand_get()…
-
Low 3.8
Team admin can escalate a team member's permissions via the team member roles endpoint
Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-…
-
Low 3.7
Open5GS 2.6.1 through 2.8.0 Out-of-Bounds Read via parse_scheme_output
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byt…
-
Low 2.3
Improper Restriction of Excessive Authentication Attempts in boneIO
boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising use…
-
Low 2.7
Mattermost OpenID discovery endpoint request bypasses outbound connection filtering, allowing SSRF by a System Administrator
Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request which allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unau…
-
Low 3.5
Improper post type validation on scheduled post endpoints
Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths which allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post e…
-
Low 2.1
CRLF injection in Proxy-Authorization header built from proxy_auth_fun in hackney
Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in hackney_http_connect in benoitc hackney allows HTTP Request Splitting via the value a proxy_auth_fun callback returns. After a 407 response from an …
-
Low 3.1
MacCMS v10 through 2026.1000.4056 Race Condition via Card Redemption
MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pas…
-
Low 3.3
Kameleo Profile Controller t.cs ListProfiles information disclosure
A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack …