CVE Vulnerability Catalog

A vulnerability in Apple iOS, iPadOS, and macOS Sequoia allows memory corruption when processing a specially crafted file. The issue is addressed with improved memory handling in iOS 18.6, iPadOS 18.6, and macOS Sequoia 15.6.

The issue was addressed with improved checks in macOS Sequoia 15.1. A malicious application may be able to modify protected parts of the file system.

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.1. An attacker with physical access can input keyboard events to apps running on a locked device.

In macOS Sequoia 15.1, a permissions issue was fixed that allowed an app to execute arbitrary code out of its sandbox or with elevated privileges.

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.1. A malicious application with root privileges may be able to access private information.

A permissions issue in macOS Sequoia allowed apps to access Contacts without user consent. This is fixed in macOS Sequoia 15.1.

A race condition was fixed in macOS Sequoia 15.1 that allowed an app to break out of its sandbox. The vulnerability exists in an unspecified system component.

HiSecOS web server versions 03.4.00 prior to 04.1.00 contain a privilege escalation vulnerability. Authenticated users with operator or auditor roles can send crafted packets to gain administrator privileges.

A vulnerability was determined in projectworlds Car Rental Project 1.0. The affected element is an unknown function of the file /login.php of the component Parameter Handler. This manipulation of the argument uname causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

listmonk from version 4.1.0 to before 6.1.0 has a session management vulnerability that allows previously issued authenticated sessions to remain valid after password reset or change. An attacker with a valid session cookie can retain access to the account even after the victim changes their password.

Rack versions from 3.0.0.beta1 to 3.1.20 and 3.2.0 to 3.2.5 have a DoS vulnerability in the multipart parser. An unauthenticated attacker can send a crafted multipart/form-data request with many parts containing long escaped parameter values, causing excessive CPU usage during parsing.

DbGate versions 7.0.0 through 7.1.4 have a stored XSS vulnerability because attacker-controlled SVG icons are rendered as raw HTML without sanitization. In the web UI this allows script execution in another user's browser; in the Electron desktop app it can escalate to local code execution.

In xmldom versions 0.6.0 and prior and @xmldom/xmldom prior to 0.8.12 and 0.9.9, an attacker can insert a string containing the CDATA terminator ]]> into a CDATASection node. During serialization, XMLSerializer emitted the CDATA content verbatim without rejecting or safely splitting the terminator, enabling XML structure injection and downstream business-logic manipulation. The issue is patched in xmldom 0.6.0 and @xmldom/xmldom 0.8.12 and 0.9.9.

Ash Framework before version 3.22.0 in Ash.Type.Module.cast_input/2 unconditionally creates a new Erlang atom via Module.concat([value]) for any user-supplied binary string starting with "Elixir.", without verifying whether the module exists. Erlang atoms are never garbage-collected and the BEAM atom table has a hard default limit of approximately 1,048,576 entries.

Postiz is an AI social media scheduling tool. Prior to version 2.21.3, the GET /public/stream endpoint in PublicController accepts a user-supplied url query parameter and proxies the full HTTP response back to the caller. The only validation is url.endsWith('mp4'), which is trivially bypassable by appending .mp4 as a query parameter value or URL fragment. The endpoint requires no authentication and has no SSRF protections, allowing an unauthenticated attacker to read responses from internal services, cloud metadata endpoints, and other network-internal resources.

Postiz before version 2.21.3 in the POST /public/v1/upload-from-url endpoint fetches user-supplied URLs without SSRF protections. File extension validation is easily bypassed. An authenticated user can read internal network resources and cloud metadata.

SillyTavern prior to version 1.17.0 contains a path traversal vulnerability in chat endpoints that allows an authenticated attacker to read and delete arbitrary files under their user data root (for example secrets.json and settings.json) by supplying avatar_url="..". This issue has been patched in version 1.17.0.

SillyTavern before version 1.17.0 contains a path traversal vulnerability in /api/chats/import, allowing authenticated attackers to write files outside the intended chats directory by injecting traversal sequences into character_name.

The TP-Link Tapo C520WS v2.6 camera has an authentication bypass vulnerability in the HTTP handling of the DS configuration service. Inconsistent parsing and authorization logic in JSON requests allows an unauthenticated attacker to append an authentication-exempt action to a request containing privileged DS actions, bypassing access controls.

In OpenSSH before 10.3, a file downloaded by scp may be installed with setuid or setgid bits if the download is performed as root with -O (legacy scp protocol) and without -p (preserve mode).