CVE Vulnerability Catalog

Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network.

Hirschmann EagleSDV version 05.4.01 before 05.4.02 has a denial-of-service vulnerability during session establishment using TLS 1.0 or TLS 1.1. An attacker can initiate TLS connections with these versions, causing the device to crash.

Stored API keys in the temporary browser client are not marked as protected, allowing extraction via JavaScript console or other errors. Attackers can obtain encryption credentials.

HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 have a denial-of-service vulnerability in the web interface. A remote attacker can send a malicious HTTP GET request to a specific endpoint, causing an uncontrolled reboot of the device.

A denial-of-service vulnerability in Hirschmann EagleSDV firmware prior to version 05.4.02 during TLS session establishment allows attackers to crash the device during TLS handshake by exploiting protocol downgrades to TLS 1.0 or TLS 1.1.

In OneUptime prior to version 10.0.42, the SAML SSO implementation decouples signature verification from identity extraction. An attacker can prepend an unsigned assertion with an arbitrary identity before a legitimately signed one, leading to authentication bypass.

Bulwark Webmail before version 1.4.10 has a vulnerability in verifyIdentity() that returned true when no session cookies were present. This allows unauthenticated attackers to bypass security and access the /api/settings endpoint, modifying user settings.

Bulwark Webmail prior to version 1.4.10 exposed the user's plaintext password in the JSON response from the GET /api/auth/session endpoint. This exposed credentials to browser logs, local caches, and network proxies.

An arbitrary code execution vulnerability in Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02. An attacker can exploit it when an administrator opens a maliciously crafted project file. Code execution occurs in the context of the HiVision process.

In Kiro IDE before version 0.8.140, unsanitized input during web page generation in the Kiro Agent webview allows a remote unauthenticated attacker to execute arbitrary code via a crafted color theme name. This requires the user to trust the workspace when prompted.

In appsmithorg appsmith up to version 1.97, there is a server-side request forgery (SSRF) vulnerability in the computeDisallowedHosts function in WebClientUtils.java in the Dashboard component. The attack can be launched remotely, and the exploit is publicly available.

OneUptime before version 10.0.42 registers multiple notification API endpoints without authentication middleware, while sibling endpoints use it. Combined with a projectId leak from the public Status Page API, an unauthenticated attacker can purchase phone numbers on the victim's Twilio account and delete existing alerting numbers.

A vulnerability in Haraka mail server (Node.js) prior to version 3.1.4 allows sending an email with __proto__ as a header name to crash the Haraka worker process.

The Go MCP SDK prior to version 1.4.0 does not enable DNS rebinding protection by default for HTTP-based servers. When an MCP server runs on localhost without authentication using StreamableHTTPHandler or SSEHandler, a malicious website can exploit DNS rebinding to bypass same-origin policy and send requests to the local MCP server, potentially invoking tools or accessing resources.

Hytale Modding Wiki version 1.2.0 and earlier has a vulnerability in the quickUpload() endpoint. The MIME type is checked, but the filename is constructed from the client-supplied extension. An attacker can upload a PHP file that gets executed server-side.

goshs versions 1.1.0 through 2.0.0-beta.2 allow bypassing Share Token restrictions, granting full functionality including code execution. Fixed in version 2.0.0-beta.2.

OpenClaw prior to commit b57b680 has an approval bypass vulnerability due to inconsistent environment variable normalization between approval and execution paths. Attackers can inject attacker-controlled environment variables into execution, bypassing approval validation.

macOS Sequoia 15.6 fixes a memory handling issue when processing maliciously crafted images. This vulnerability could corrupt process memory.

Improved symlink handling in macOS Sequoia 15.6 prevents an app from breaking out of its sandbox.

A vulnerability in macOS Sequoia 15.6 allows process memory corruption when processing a maliciously crafted image. The issue was addressed with improved memory handling.