CVE Vulnerability Catalog

A use-after-free vulnerability in libxslt while parsing xsl nodes can lead to dereference of expired pointers and application crash.

Lobe Chat is an open-source artificial intelligence chat framework. Prior to version 1.130.1, the project's OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value. In deployments where a reverse proxy forwards client-supplied X-Forwarded-* headers to the origin as-is, or where the origin trusts them without validation, an attacker can inject an arbitrary host and trigger an open redirect that sends users to a malicious domain. This issue has been patched in version 1.130.1.

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands as root on the underlying operating system of an affected device. This is due to insufficient validation of user arguments passed to specific CLI commands. An attacker could log in with level 15 credentials and use crafted commands.

A vulnerability in the access control list (ACL) programming of Cisco IOS XE Software for Cisco Catalyst 9500X and 9600X Series Switches could allow an unauthenticated, remote attacker to bypass a configured ACL on an affected device. This vulnerability is due to the flooding of traffic from an unlearned MAC address on a switch virtual interface (SVI) that has an egress ACL applied. An attacker could exploit this vulnerability by causing the VLAN to flush its MAC address table. This condition can also occur if the MAC address table is full. A successful exploit could allow the attacker to bypass an egress ACL on an affected device.

A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to execute persistent code at boot time and break the chain of trust. This is due to improper validation of software packages. An attacker could place a crafted file in a specific location on the device.

Multiple vulnerabilities in Cisco IOS XE Software due to path traversal and improper image integrity validation could allow an authenticated local attacker with level-15 privileges or an unauthenticated attacker with physical access to execute persistent code at boot time and break the chain of trust.

A vulnerability in the Day One setup process of Cisco IOS XE Software for Catalyst 9800 Series Wireless Controllers for Cloud (9800-CL) could allow an unauthenticated, remote attacker to access the public-key infrastructure (PKI) server running on an affected device. This is due to incomplete cleanup upon completion of the Day One setup process. An attacker could send SCEP requests to the device, obtain a certificate from the virtual wireless controller, and use it to join an attacker-controlled device to the controller.

A vulnerability in the Web Authentication feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting attack (XSS) on an affected device. This is due to improper sanitization of user-supplied input.

A vulnerability in the CLI of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, local attacker to cause an affected device to reload unexpectedly, resulting in a denial of service (DoS) condition. This is due to a buffer overflow, and an attacker with a low-privileged account could exploit it using crafted commands.

A vulnerability in the IPv6 Router Advertisement (RA) packet processing of Cisco Access Point Software could allow an unauthenticated, adjacent attacker to modify the IPv6 gateway on an affected device. The vulnerability is due to a logic error when processing IPv6 RA packets from wireless clients. A successful exploit could temporarily change the IPv6 gateway and cause intermittent packet loss for associated wireless clients.

A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point (AP) Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vulnerability is due to insufficient verification checks of incoming 802.11 action frames.

A vulnerability in the access control list (ACL) processing of IPv4 packets of Cisco SD-WAN vEdge Software could allow an unauthenticated, remote attacker to bypass a configured ACL. This vulnerability is due to the improper enforcement of the implicit deny all at the end of a configured ACL. An attacker could exploit this vulnerability by attempting to send unauthorized traffic to an interface on an affected device.

Information disclosure when Video engine escape input data is less than expected minimum size.

Information disclosure while running video usecase having rogue firmware.

Information disclosure while invoking calibration data from user space to update firmware size.

In Puppet Enterprise versions 2025.4.0 and 2025.5, the encryption key used for encrypting content in the Infra Assistant database was not excluded from the files gathered by Puppet backup. The key is only present on the system if the user has a Puppet Enterprise Advanced license and has enabled the Infra Assistant feature. The key is used for encrypting one particular bit of data in the Infra Assistant database: the API key for their AI provider account. This has been fixed in Puppet Enterprise version 2025.6, and release notes for 2025.6 have remediation steps for users of affected versions who can't update to the latest version.

When extracting a tar archive, pip may not check that symbolic links point into the extraction directory if the tarfile module does not implement PEP 706. This vulnerability only affects Python versions that do not implement PEP 706, and upgrading pip alone does not fix all tarfile-related issues. It is recommended to use a Python version with PEP 706 or a patched pip.

NVIDIA nvJPEG library contains a vulnerability where an attacker can cause an out-of-bounds read by means of a specially crafted JPEG file. A successful exploit might lead to information disclosure or denial of service.

The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via several parameters in all versions up to, and including, 7.6.9 due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or higher can inject arbitrary scripts into pages that execute whenever a user visits the injected page. The vulnerability was partially patched in version 7.6.9.