CVE Vulnerability Catalog

NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands via a crafted API request. Successful exploitation might lead to code execution, privilege escalation, and information disclosure.

NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic key to extract information. Successful exploitation might lead to information disclosure and privilege escalation.

The Kaltura HTML5 player (mwEmbed / html5lib) contains a local file disclosure vulnerability due to improper validation of the ServiceUrl parameter in mwEmbedLoader.php. This parameter is used as the base URL for a backend request and accepts non-HTTP schemes such as file://. When an exception or error occurs, the response is subsequently deserialized and its raw contents are reflected to the client in an error message; this enables an unauthenticated, remote attacker to read any arbitrary internal file reachable by the server.

The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user-controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker-supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web-accessible locations and achieve code execution as the webserver user.

An integer overflow vulnerability leading to an out-of-bounds write was discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file.

An integer conversion vulnerability leading to an out-of-bounds read when loading images was discovered in NI LabVIEW. This may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI file.

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions.

The Zephyr ext2 filesystem driver contains an out-of-bounds read vulnerability triggered when mounting a crafted ext2 image. The ext2_bitmap_count_set() function scans memory based on unvalidated superblock values, potentially reading about 512 MB past the bitmap buffer.

A vulnerability in the OCPP 1.6 client in Zephyr (subsys/net/lib/ocpp/ocpp.c) causes a NULL pointer dereference when processing CALLRESULT messages. A server can send a uid without a '-' delimiter, leading to atoi(NULL) and a crash of the OCPP reader thread. The flaw is remotely reachable via a malicious or compromised central system or MITM on a ws:// connection.

The virtio PCI driver in Zephyr OS (drivers/virtio/virtio_pci.c) improperly validates the capability length (cap_len) read from PCI configuration space. The lack of runtime validation (assert is disabled in production builds) leads to an out-of-bounds write on the kernel stack during device initialization.

X-AnyLabeling's model downloader disabled TLS certificate verification. The download_with_retry function uses an unverified SSL context, allowing an attacker to intercept the connection and replace the downloaded model. The substituted file can be used to execute arbitrary code or influence annotation results.

The Vocos library instantiates a class named by a configuration file without restricting which class may be named. The instantiate_class function imports the module and calls the specified attribute with arguments from the config, allowing arbitrary code execution. Loading a model from a Hugging Face repository not controlled by the user can execute code chosen by the repository owner.

rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set setuid/setgid bits on attacker-controlled files. When copying with metadata preservation from an untrusted remote, attackers can plant a setuid binary that escalates privileges to root if rclone runs as root.

rclone before 1.74.4 fails to strip the X-Amz-Security-Token header when an S3 redirect changes scheme from HTTPS to HTTP on the same host. Attackers can intercept plaintext HTTP traffic to capture AWS STS session tokens sent in request headers.

rclone serve s3 before version 1.74.4 contains a path traversal vulnerability that allows attackers to read and overwrite root-level files by using dot-dot segments in S3 object keys. Attackers can send requests with object keys like '../root-secret.txt' to escape the bucket namespace and access files in the serve root directory.

rclone before v1.75.0 fails to sanitize IBM IAM bearer tokens and SSE-C encryption keys during S3 redirect callbacks, allowing credentials to be preserved across scheme or host changes. Attackers observing network traffic from a trusted endpoint can capture reusable IBM IAM tokens on same-host HTTPS-to-HTTP downgrades or SSE-C keys on cross-origin redirects to access protected S3 objects.

rclone versions before v1.75.0 fail to reject transport downgrades in redirect handling, allowing Basic authorization and Cookie headers to be replayed over plaintext HTTP after same-host HTTPS-to-HTTP redirects. An on-path attacker observing the plaintext hop can capture and reuse credentials to perform WebDAV operations with the compromised account's permissions.

rclone before v1.75.0 contains a denial of service vulnerability in the WebDAV TUS creation handler that dereferences a nil response before checking for transport errors. A malicious or compromised configured endpoint can reset connections during TUS uploads to trigger a panic that terminates unrecovered goroutines and halts unrelated work in long-lived processes.

rclone before v1.75.0 includes full Go stack traces in RC API error responses when panics occur. Attackers can trigger panics to leak internal file paths, module versions, goroutine states, and memory addresses.