CVE Vulnerability Catalog

In libexpat before version 2.7.5, a NULL pointer dereference vulnerability exists when processing empty external parameter entity content. This can cause a crash in applications using this library.

Vulnogram 1.0.0 contains a stored cross-site scripting vulnerability in comment hypertext handling that allows attackers to inject malicious scripts. Remote attackers can inject XSS payloads through comments to execute arbitrary JavaScript in victims' browsers.

Wersje Samsung Account przed 15.5.01.1 zawierają lukę w przekierowaniu URL, która może umożliwić lokalnym atakującym uzyskanie tokena dostępu.

ZKTeco ZKBioSecurity 3.0 contains a local authorization bypass vulnerability in visLogin.jsp that allows attackers to authenticate without valid credentials by spoofing localhost requests.

ZKTeco ZKBioSecurity 3.0 contains a file path manipulation vulnerability that allows attackers to access arbitrary files by modifying file paths used to retrieve local resources.

ZKTeco ZKBioSecurity 3.0 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visiting malicious websites. Attackers can craft HTTP requests that add superadmin accounts without validity checks, enabling unauthorized administrative access.

ZKTeco ZKBioSecurity 3.0 contains multiple reflected XSS vulnerabilities that allow attackers to execute arbitrary HTML and script code by injecting malicious payloads through unsanitized parameters in multiple scripts.

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

OneUptime prior to 10.0.24 logs the complete password reset URL — containing the plaintext reset token — at INFO log level, which is enabled by default in production. Anyone with access to application logs can intercept reset tokens and perform account takeover on any user.

Missing Authorization vulnerability in E2Pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects e2pdf from n/a through <= 1.28.15.

Serwer OpenSSL TLS 1.3 może nie negocjować preferowanej grupy wymiany kluczy, gdy jego konfiguracja grupy wymiany kluczy zawiera domyślną wartość 'DEFAULT'. W wyniku tego może być używana mniej preferowana grupa, nawet jeśli zarówno klient, jak i serwer obsługują bardziej preferowaną grupę.

Erlang OTP SSH (ssh_transport module) advertises legacy zlib compression by default, allowing a decompression bomb attack pre-authentication. Each SSH packet can decompress ~255 MB from 256 KB of data (1029:1 ratio), leading to memory exhaustion and DoS. Affects OTP from 17.0 before 28.4.1, 27.3.4.9, and 26.2.5.18.

The ssh_sftpd module in Erlang OTP before OTP 28.4.1, 27.3.4.9, and 26.2.5.18 uses string prefix matching instead of proper path component validation. Authenticated users can access sibling directories that share a common name prefix with the configured root directory.

Uncontrolled Resource Consumption vulnerability in hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hex.pm before 2026-03-10.

A container privilege escalation vulnerability was found in Multi-Cloud Object Gateway Core images. The issue is caused by the /etc/passwd file being created with group-writable permissions during build time. An attacker with command execution access inside the container, even as a non-root user, can exploit membership in the root group to modify /etc/passwd and add a user with arbitrary UID, including 0, leading to full root privileges.

W niektórych obrazach Fuse odkryto lukę umożliwiającą eskalację uprawnień w kontenerze. Problem wynika z pliku /etc/passwd, który jest tworzony z uprawnieniami do zapisu dla grupy podczas budowy, co pozwala atakującemu na modyfikację tego pliku.

Mechanizm uwierzytelniania w module EasyShare zawiera podatność. W przypadku spełnienia określonych warunków w lokalnej sieci, może dojść do wycieku danych.

In Vim, the NFA regex compiler, when encountering a collection containing a combining character as the endpoint of a character range (e.g. [0-0\u05bb]), incorrectly emits the composing bytes of that character as separate NFA states. This corrupts the NFA postfix stack, resulting in a segmentation fault when estimating match width for look-behind assertions. This vulnerability is fixed in version 9.2.0137.

W systemie mirror-registry znaleziono lukę, która pozwala uwierzytelnionemu użytkownikowi na oszukanie systemu w celu uzyskania dostępu do niezamierzonych wewnętrznych lub zastrzeżonych systemów poprzez podanie złośliwych adresów internetowych. Aplikacja automatycznie podąża za przekierowaniami bez weryfikacji ostatecznego celu.

Local File Inclusion vulnerability in Contact Plan, E-Mail, SMS and Fax components of Asseco SEE Live 2.0 allows remote authenticated users to access files on the host via the "path" parameter in downloadAttachment and downloadAttachmentFromPath API calls.