405,239 results · Feed
-
Unscored —
In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault in…
-
Medium 6.4
In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent sh…
-
Unscored —
In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-…
-
Unscored —
In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due…
-
Unscored —
In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. This could lead to lo…
-
Unscored —
In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the code. This could lead…
-
Unscored —
In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale stre…
-
Unscored —
In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a …
-
Unscored —
In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test …
-
Low 3.3
Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by…
-
Medium 4.0
Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted mess…
-
Medium 4.0
Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted …
-
Unscored —
OAuth2 access token could be sent over an unencrypted connection with Exchange accounts
For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token…
-
Unscored —
SMTP and POP3 response injection when using STARTTLS
If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as…
-
Unscored —
Feed subscriptions could leak NTLM credentials on Windows
Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to t…
-
Unscored —
Calendar server credentials could be sent to an HTTP proxy
When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, w…
-
Unscored —
Attachments could be replaced with local file content when forwarding
When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the file or URL it point…
-
High 8.4
Vulnerabilities in the QNX Neutrino kernel affect QNX Software Development Platform and QNX OS for Safety
Heap-based Buffer Overflow in the DCMD_PROC_EVENT handler of the procnto could allow an attacker with local access to cause an information disclosure, data tampering or a crash of the QNX Neutrino kernel.
-
High 7.4
Forge: X.509 nameConstraints not enforced by verifyCertificateChain()
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, pki.verifyCertificateChain() in lib/x509.js does not decode or enforce the X.509 nameConstraints extension while validating certificate paths.…
-
Low 3.7
Forge: Ed25519 signature verification accepts small-order public keys
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, ed25519.verify() decodes a public key in crypto_sign_open() without rejecting small-order points or their non-canonical encodings. With S = 0 …
-
High 7.0
AMD MmSaveStateLib SysCall path performs out-of-bounds writes for partial save-state reads
EDK2 contains vulnerabilities in BIOS where skilled and privileged users or attackers may cause “Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could compromise SMM handler integrity, cause system instability, and lead to …
-
High 8.8
Untrusted search path in the cross-user process launcher in OpenJD Sessions for Python, as used in the AWS Deadline Cloud worker agent
Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before 0.11.0, as used in the AWS Deadline Cloud worker agent before 0.33.0, on Linux might allow an authenticated remote user with permission to sub…
-
Medium 5.9
Forge: TLS client crash on a handshake record received without a session
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client can pass a handshake record to tls.handleHandshake() while the connection has no session, including after a close_notify al…
-
Medium 5.9
Forge: ReDoS in forge.http response header and cookie trimming
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. From 0.1.2 until 1.4.3, forge.http uses _trimString() in lib/http.js to remove trailing whitespace from response header values and cookie names and values wit…
-
Medium 5.9
Forge: TLS client crash on an unsupported ServerHello compression method
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.3, a forge.tls client accepts a ServerHello compression_method that it did not offer. When the client later handles ServerHelloDone, tls.createCo…
-
High 7.4
Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform
Heap-based Buffer Overflow in the io-char library's DCMD_CHR_WAITINFO devctl() handler could allow an attacker with local access to cause data tampering, arbitrary code execution, or a crash in the Character I/O device driver.
-
Medium 6.3
imaplib STARTTLS serves plaintext bytes buffered before the handshake as if they came over TLS
IMAP4.starttls() wraps the socket in TLS but leaves self._readbuf, imaplib's own read-ahead buffer, untouched. Any plaintext bytes that arrived in the same recv() as the tagged OK to STARTTLS are returned by readline() after the handshake, so the client treat…
-
Medium 5.6
Leak SMM RAM from the kernel (Simply TSA after an SMI)
EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” by local access. Successful exploitation of this vulnerability may result in disclosure of SMRAM contents. It could also…
-
Medium 6.2
Vulnerabilities in the QNX io-char library Impacts QNX Software Development Platform
Improper Input Validation in the io-char library's DCMD_CHR_TCINJECTC devctl() handler could allow an attacker with local access to cause data tampering in the memory input buffer of the Character I/O device driver.
-
Critical 9.1
HarnessRouter: Service-only routes that write an organization's provider connections could be reached through a multi-tenant console with a made-up bearer
HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation, and failure handling. Prior to 0.31.8, a console that is not in self-hosted mode attaches the server's internal key to requests carrying an A…
-
High 7.5
HarnessRouter: A workspace's API key could read and change sessions, files and responses of other workspaces in the same organization
HarnessRouter is a self-hosted unified API for agent harnesses. From version 0.4.2 until 0.31.7, routes that accept a session ID or response ID validate only the caller's organization and do not enforce the workspace scope of a non-default workspace API key. …
-
High 7.5CVE-2026-105437 Public exploit
Affected versions of Git have a heap buffer overflow in the three-way merge code (xdiff), which an attacker can trigger…
-
Medium 6.9
Heap-based buffer overflow for some Hyperscan before version v5.4.2.1 within Ring 3: User Applications may allow a deni…
-
Medium 5.1
Improper initialization in the MigTD virtio-vsock stream handling for the Intel(R) TDX Migration Trust Domain (MigTD) w…
-
Medium 5.3
Incorrect behavior order in the get_tcb_level_by_svn for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0:…
-
Medium 4.8
Integer underflow (wrap or wraparound) for some Intel(R) Metrics Discovery Application Programming Interface software b…
-
Medium 5.3
Unchecked return value in the MigTD's TLS implementation for the Intel(R) TDX Migration Trust Domain (MigTD) within Rin…
-
High 8.4
Expired pointer dereference in the MigTD's virtio-vsock implementation for the Intel(R) TDX Migration Trust Domain (Mig…
-
Medium 6.7
Unchecked return value in the MigTD error handling for the Intel(R) TDX Migration Trust Domain (MigTD) within Ring 0: H…
-
Medium 5.6
Detection of error condition without action in the MigTD's vmcall_raw transport for the Intel(R) TDX Migration Trust Do…