CVE Vulnerability Catalog

W podatności CVE-2025-61154 występuje przepełnienie bufora na stercie w wersjach LibreDWG od v0.13.3.7571 do v0.13.3.7835. Złośliwie przygotowany plik DWG może spowodować awarię usługi (DoS) poprzez funkcję decompress_R2004_section w pliku decode.c.

Użytkownik z uprawnieniami w Ignition może zaimportować zewnętrzny plik z specjalnie przygotowanym ładunkiem, co prowadzi do wykonania osadzonego złośliwego kodu.

In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context.

A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session.

An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the exploitation of a race condition where the legitimate installer is substituted with an unexpected payload immediately after download, resulting in arbitrary code execution.

A potential vulnerability in Lenovo PC Manager that could allow a local authenticated user to terminate privileged processes.

A potential divide by zero vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect. It could allow a local authenticated user to cause a Windows blue screen error.

A potential buffer overflow vulnerability was reported in the Lenovo Virtual Bus driver used in Smart Connect. It could allow a local authenticated user to corrupt memory and cause a Windows blue screen error.

An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to obtain sensitive user data from the application.

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

A vulnerability in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) allows an unauthenticated, remote attacker to perform cross-site scripting (XSS) attacks against a user of the interface. The issue is due to insufficient validation of user-supplied input.

In the GNU C Library version 2.36 on x86_64 systems, calling functions that use nscd caching may cause a crash. The issue stems from an optimized memcmp implementation that, when inputs are concurrently modified by other threads, can crash the nscd client and the application using it.

Podatność CVE-2026-3784 dotyczy narzędzia curl, które błędnie ponownie wykorzystuje istniejące połączenie HTTP proxy podczas wykonywania żądania CONNECT do serwera, nawet jeśli nowe żądanie używa innych poświadczeń dla proxy. Oczekiwane zachowanie to utworzenie lub użycie oddzielnego połączenia.

When an OAuth2 bearer token is used for an HTTP(S) transfer and that transfer redirects to a second URL, curl may leak the token to the second hostname under some circumstances. If the redirect target hostname has an entry in the .netrc file with the machine or default keyword, curl passes the bearer token set for the first host to the second one.

libcurl contains a logical error in its connection reuse mechanism. Under certain circumstances, an HTTP or HTTPS request using Negotiate authentication may wrongly reuse an existing connection that was authenticated with different credentials. As a result, a second request with different credentials may be sent over a connection authenticated for the first user.

Adobe Commerce versions up to 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a Path Traversal vulnerability that could result in a security feature bypass. A high-privileged attacker could access unauthorized files or directories outside the intended restricted path. Exploitation does not require user interaction.

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and have limited impact on data integrity and availability. Exploitation depends on conditions beyond the attacker's control and does not require user interaction.

Adobe Commerce versions up to 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, with limited impact to integrity. Exploitation does not require user interaction.

Adobe Commerce versions up to 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could bypass security measures and gain limited unauthorized access to a feature. Exploitation does not require user interaction.

Adobe Commerce versions up to 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could bypass security measures and gain limited unauthorized view access of data. Exploitation does not require user interaction.