CVE Vulnerability Catalog

In affected versions of MISP, a submitted sharing group is not authorized in a specific event-edit path. The vulnerable logic checked whether the acting user could use a sharing_group_id only when the request explicitly supplied distribution = 4; omitting distribution while supplying a different sharing_group_id skipped that check, and field-recovery logic restored the existing event distribution. The fix adds authorization checks in the controller and Event::_edit(). Affected versions: ≤2.5.45.

A vulnerability was detected in GNU Binutils 2.47 in the function elf_x86_allocate_dynrelocs in bfd/elfxx-x86.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GNU Binutils 2.47 in the function elf_x86_64_common_section_index in bfd/elf64-x86-64.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GNU Binutils 2.47 in the function elf_link_add_object_symbols in bfd/elflink.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GNU Binutils 2.47 in the function _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

CVE-2026-87730 has been rejected — it is not considered a valid vulnerability. No technical details are available because the submission was withdrawn.

A hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands. It requires SSH login and enable mode access.

An improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane (NETCONF) may execute arbitrary OS commands. It requires access to the NETCONF interface.

Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a local low-privileged attacker to escalate privileges to NT AUTHORITY\SYSTEM via an attacker-controlled preload.json file. It requires local access to the machine.

A privilege escalation flaw exists in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs mysqld --validate-config --log-error-verbosity=2 directly as root, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object into /var/lib/mysql, setting plugin_dir and early_plugin_load so MySQL loads the attacker-controlled object during configuration validation. When an administrator subsequently runs the Leapp preupgrade or upgrade workflow, attacker-controlled code can execute as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t).

A vulnerability in MISP arises from relying on CakePHP's request-method override processing, which can disable CSRF and form-security validation. CakePHP honors the _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the standard verbs (POST, PUT, PATCH, DELETE), CakePHP clears the request body, causing MISP to skip _validatePost() and _validateCsrf(). An attacker can send a form with _method=GET to bypass protections.

In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker, including the built-in worker. Incorrect permission validation during script execution allowed the script to run without the user having the required authorization.

A vulnerability in GPAC up to f1219cde affects the function gf_node_list_insert_child in scenegraph/base_scenegraph.c, leading to memory corruption. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version abi-16.23 is recommended to resolve the issue.

A vulnerability was detected in GPAC up to f1219cde in the function gf_node_activate_ex in scenegraph/base_scenegraph.c, leading to a stack-based buffer overflow. The attack requires local access, and the exploit is public.

A vulnerability in GPAC up to f1219cde affects the function gf_node_get_name_and_id in scenegraph/base_scenegraph.c, leading to use-after-free. The attack can be launched remotely, and the exploit is publicly available. Upgrading to version abi-16.23 is recommended.

A vulnerability in GPAC up to f1219cde affects the function gf_url_concatenate_ex in utils/url.c, leading to a heap-based buffer overflow. The attack must be approached locally. Upgrading to version abi-16.23 is recommended to address the issue.

In GPAC up to f1219cde, a flaw in the function gf_mo_get_od_id in compositor/media_object.c of the Compositor component can lead to use-after-free. The attack can be performed remotely, and the exploit has been published. Upgrading to version abi-16.24 resolves the issue.

A heap-based buffer overflow has been detected in GPAC in the mpgviddmx_process function of filters/reframe_mpgvid.c in the MPEG Video Reframer component. The vulnerability can be exploited remotely and a public exploit is available. The issue is fixed in version abi-16.23.

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0 in the move_uploaded_file function of production/edit_picture.php in the Profile Picture Upload component. Manipulating the File argument results in unrestricted file upload. The attack can be carried out remotely and a public exploit is available.

proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, backing Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet. Because the socket peer then becomes trusted at hop 0, any unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads.