CVE Vulnerability Catalog

A vulnerability in scitokens-cpp prior to version 1.4.1 allows authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path but collapses '..' components instead of rejecting them, allowing an attacker to broaden authorization beyond the intended directory.

My Location Travel Timeline v11.80 from Squareapps LLC has an arbitrary file overwrite vulnerability during file import, which can lead to arbitrary code execution or information exposure.

PDF Reader App : TA/UTAX Mobile Print v3.7.2.251001 has an arbitrary file overwrite vulnerability during file import, which can lead to arbitrary code execution or information exposure.

A security audit identified a privilege escalation vulnerability in Operations Agent (<=OA 12.29) on Windows. Under specific conditions Operations Agent may run executables from specific writeable locations.

In HAPI FHIR before version 6.9.4, ManagedWebAccessUtils.getServer() uses String.startsWith() to match request URLs against configured server URLs for credential dispatch. Without a trailing slash or host boundary check, an attacker-controlled domain like http://tx.fhir.org.attacker.com matches the prefix and receives Bearer tokens, Basic auth credentials, or API keys when the HTTP client follows a redirect.

NVIDIA BioNeMo contains a vulnerability that allows deserialization of untrusted data. Successful exploitation could lead to code execution, denial of service, information disclosure, and data tampering.

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

NVIDIA Jetson Linux has a vulnerability in initrd where an unprivileged attacker with physical access can inject incorrect command line arguments. Successful exploitation may lead to code execution, privilege escalation, DoS, data tampering, and information disclosure.

NVIDIA Jetson for JetPack contains a vulnerability in system initialization logic, where an unprivileged attacker can cause initialization of a resource with an insecure default.

The Tenda CH22 router version 1.0.0.1 has a stack-based buffer overflow vulnerability in the formWebTypeLibrary function in /goform/webtypelibrary. Manipulating the webSiteId argument allows remote code execution. The exploit has been publicly disclosed.

The PAGI::Middleware::Session::Store::Cookie module for Perl generates random bytes insecurely. If reading from /dev/urandom fails, it falls back to the rand function, which is not cryptographically secure. This can lead to a predictable initialization vector (IV) for encrypting session cookies.

Parse Server before versions 8.6.68 and 9.7.0-alpha.12 has a DoS vulnerability via GraphQL. By sending a crafted query with binary fan-out fragment spreads, an unauthenticated attacker can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments with requestComplexity.graphQLDepth or requestComplexity.graphQLFields enabled.

The JOSE library before version 0.3.5+1 allows an unauthenticated remote attacker to forge JWS/JWT tokens by using a key embedded in the JOSE header (jwk). The library incorrectly treats header-provided keys as verification candidates even when not in the trusted key store.

Sliver before version 1.7.4 has a vulnerability where a single click on a malicious link gives an unauthenticated attacker immediate control over all active C2 sessions and beacons via the operator's browser, enabling data exfiltration or infrastructure destruction.

An arbitrary file overwrite vulnerability in UXGROUP LLC Voice Recorder v10.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

The Anthropic Claude installer for Windows (Claude Setup.exe) prior to version 1.1.3363 is vulnerable to DLL hijacking due to uncontrolled search path, allowing local privilege escalation.

OpenClaw before 2026.3.28 has an SSRF vulnerability in the fal provider image-generation-provider.ts component. Attackers can exploit unguarded image downloads to expose internal service metadata and responses through the image pipeline.

OpenClaw before 2026.3.28 fails to disconnect active WebSocket sessions when devices are removed or tokens are revoked. Attackers with revoked credentials can maintain unauthorized access through existing live sessions until forced reconnection.

ZEBRA (Zcash node) prior to zebrad 4.3.0 and zebra-consensus 5.0.1 has a logic error in the transaction verification cache. A malicious miner can induce a consensus split by matching a valid transaction's txid with invalid authorization data, causing vulnerable nodes to accept an invalid block.

Parse Server prior to versions 8.6.66 and 9.7.0-alpha.10 does not respect the allowOrigin server option in the GraphQL API, unconditionally allowing cross-origin requests from any website. The REST API correctly enforces this restriction.