CVE Vulnerability Catalog

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers. This vulnerability represents an incomplete remediation of CVE-2026-0714, where TPM2 parameter encryption does not provide effective protection due to an omission.

Lack of restriction on the number of attachment headers in Apache CXF during message deserialization can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2, 4.1.7, or 3.6.12, which impose a default maximum of 500 attachments per message.

A JNDI Injection vulnerability in Apache CXF's JCA integration module can allow code execution if an attacker can manipulate the JCA deployment descriptor or runtime activation parameters.

A further incomplete fix for CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) in Apache CXF has been identified, which can still allow code execution if untrusted users are allowed to configure JMS.

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same refresh token to bypass single-use semantics and generate multiple valid access tokens when 'recycleRefreshTokens' is set to false. Users are recommended to upgrade to versions 4.2.2, 4.1.7, or 3.6.12.

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenticated remote attackers to exploit this vulnerability to delete arbitrary system files or directories, resulting in data destruction or service disruption.

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an OS Command Injection vulnerability, allowing privileged remote attackers to inject arbitrary OS commands and execute them on the device.

The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, allowing authenticated remote attackers to bypass the enforced command restrictions and execute operating system commands outside the originally authorized scope.

A vulnerability in Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 allows unexpected service termination. Under specific circumstances and configurations, processing unexpected input could lead to a localized denial of service (DoS).

Netty, a network application framework, prior to version 4.2.15.Final had a default configuration for `Http3ConnectionHandler` that did not enforce a maximum header size limit. This lack of restriction allows malicious clients or servers to send an enormous number of headers, leading to memory exhaustion and Denial of Service attacks.

Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow, resulting in a victim's account being linked to an attacker-controlled account.

Under certain network configurations, a malicious actor with access to the network could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

A Path Traversal vulnerability has been identified in devices running UniFi OS, which can be exploited by a malicious actor with network access. This allows for data retrieval from such UniFi OS devices or instances.

Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.

Idira Vendor PAM - Self-Hosted Connector versions prior to 1.1.100504 may not fully enforce TLS certificate validation under specific conditions and configuration scenarios.

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who can run server-side JavaScript may cause the server to access memory that has already been freed.

ClipBucket v5 is an open source video sharing platform that prior to version 5.5.3 - #132 had a vulnerability allowing authenticated users to add multiple subtitles from different files and change their titles. The POST /actions/subtitle_edit.php request used to change titles includes a number parameter that is vulnerable to SQL Injection.

An authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally controlled data is interpreted as a format string, which can lead to stack memory manipulation.

Idira Endpoint Privilege Manager Linux Agent versions prior to 26.5 allow a local attacker to potentially compromise the agent daemon initialization.

Due to incomplete input validation in Idira Privileged Session Manager for SSH (PSMP) versions prior to 15.0.2, 14.6.3, 14.2.5, and 14.0.6, an authenticated, low-privileged user could potentially execute arbitrary commands on the PSMP host.