106,954 results · Clear filters · Feed
-
Medium 5.5
This issue was addressed with improved input validation. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden …
-
Medium 5.5
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS…
-
Medium 5.5
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 2…
-
Medium 5.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS…
-
Medium 5.5
A file access issue existed with certain home folder files. This was addressed with improved access restrictions. This …
-
Medium 5.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, …
-
Medium 6.5
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS …
-
Medium 4.3
The issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, …
-
Medium 5.2
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 4.3
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 an…
-
Medium 6.1
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.…
-
Medium 6.5
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2,…
-
Medium 5.4
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.…
-
Medium 5.5
A type confusion issue was addressed with improved checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. An app may …
-
Medium 5.5
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 2…
-
Medium 5.5
An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27.2, mac…
-
Medium 6.5
A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iO…
-
Medium 4.4
The issue was addressed with improved memory handling. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and …
-
Medium 5.5
A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27.2. An app may b…
-
Medium 5.9
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. From 26.7.1 until 26.10.1, PerMessageBrotli.decompress_message_data in compress_brotli.py calls the Brotli decompressor without an output limit and checks max…
-
Medium 5.3
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, Tornado's HTTP header parser accepts obsolete line folding and repeatedly concatenates short continuation lines, causing quadratic CPU consumption on the IOLoop thread. An un…
-
Medium 4.4
turboderp-org ExLlamaV2 GPTQ Index q_matrix.cu make_sequential out-of-bounds write
A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_id…
-
Medium 6.3
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_…
-
Medium 4.1
Stored Cross-Site Scripting in Web Interface
Some externally supplied values stored by the device may be rendered in the web interface without sufficient output encoding. An attacker who can influence one of these values could cause script execution in the browser of a user who views an affected page. E…
-
Medium 5.9
Timing side-channel in pure-Erlang X25519 scalar multiplication leaks the private key in jose
Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key through a timing side channel in the pure-Erlang Curve25519 fallback. The pure-Erlang X25519 implementation performs scalar multiplication over t…
-
Medium 5.1
ECDSA signature length is not validated in jose, allowing signature malleability
The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical length. When verifying an ECDSA signature, jose_jwk_kty_ec:verify/4 in src/jwk/jose_jwk_kty_ec.erl splits the raw signature in half by its actual byte length (s…
-
Medium 6.9
erlang-jose RSA JWK parsing attempts to factor an attacker-controlled modulus, enabling CPU-exhaustion denial of service
Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion denial of service by submitting a crafted RSA JSON Web Key. When an application parses an untrusted JWK through the public jose_jwk:from_bina…
-
Medium 5.9
Infinite recursion (CPU denial-of-service) in JOSE.JWK.shared_secret/2 on mismatched key types
jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKs. Its first function clause only matches when both JWKs carry the same key type (kty) module, and its fallback clause re-invokes itself as shar…
-
Medium 6.9
Decompression bomb via unbounded zlib:inflate in jose_jwe_zip:uncompress/2
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows a remote attacker to exhaust a node's memory with a small crafted JWE token. The jose_jwe_zip:uncompress/2 function in src/jwe/jose_jwe_zip…
-
Medium 6.3
Asterisk: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, insufficient bounds checking in the `chan_ooh323` `Q.931` `information-element parser…
-
Medium 5.9
Bleichenbacher padding oracle in RSAES-PKCS1-v1_5 decryption in jose
The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracle. eme_pkcs1_decode/2 returns the recovered message when a decrypted block has valid PKCS#1 v1.5 padding (a leading 0x00 0x02, a padding string of at lea…
-
Medium 5.9
Attacker-controlled AES-GCM authentication tag length allows tag forgery in jose
The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the attacker-supplied tag itself. In the {aes_gcm, Bits} clause of block_decrypt/4, the incoming tag is guarded only by is_binary/1, with no check on …
-
Medium 5.3
Unauthorized Access to Internal Web Resources
An access-control vulnerability has been identified in the web server configuration. Some resources intended for on-device use only could be accessed remotely by an unauthenticated attacker with network access to the web interface. The accessible resources do…
-
Medium 6.9
Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through…
-
Medium 5.3
Resource Exhaustion in MICE Service
A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment (MICE) service. An unauthenticated attacker with network access to the MICE service could consume available connection capacity, preventing legi…
-
Medium 4.3
a2aproject a2a-java JSON-RPC Error getMessage information exposure
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading …
-
Medium 5.3
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by processing body data that has already arrived without yielding to the event loop. A remote unauthenticated peer can se…
-
Medium 5.3
a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is p…