CVE Vulnerability Catalog

WWBN AVideo is an open source video platform that, in versions up to 29.0, allows unauthenticated users to read APISecret from objects/plugins.json.php. This enables them to call protected API endpoints, such as users_list, without logging in.

AVideo is an open source video platform that is vulnerable to SSRF attacks in versions up to 29.0. Two endpoints improperly validate user-supplied URLs, allowing an attacker to redirect to internal resources.

AVideo is an open-source video platform that, in versions up to 29.0, exposes the local CloneSite shared secret in the HTTP response to every unauthenticated request. This secret can be exploited by an attacker to impersonate the victim and gain access to the remote database.

In the jotty·page application prior to version 1.22.0, there is an unauthenticated path traversal vulnerability in the /api/app-icons/[filename] endpoint. The filename route parameter is joined into a filesystem path without validation, allowing file reads outside the allowed directory.

In the libcaca library version 0.99.beta20 and earlier, there is an integer overflow vulnerability in the canvas import functionality, allowing an attacker to cause a controlled heap out-of-bounds write. This may lead to memory corruption or remote code execution.

AVideo is an open-source video platform that has a vulnerability in versions up to 29.0 allowing an unauthenticated attacker to send malicious messages via WebSocket. This vulnerability arises from improper JSON data handling, enabling PHP code execution on the server.

A use after free issue was addressed with improved memory management. This issue is fixed in several versions of Apple operating systems.

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, iOS 26.7 and iPadOS 26.7, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

A validation issue was addressed with improved logic. This issue may have prevented Content Security Policy from being enforced.

A vulnerability in WebKit that could lead to an unexpected Safari crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.

An out-of-bounds write issue was addressed with improved input validation in iOS, iPadOS, and macOS. Parsing a maliciously crafted file may lead to unexpected app termination.

An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5.

The issue involves the potential disclosure of kernel memory by an app, which could lead to serious security breaches. It has been addressed with improved memory handling in various versions of Apple operating systems.

A permissions issue was addressed with additional restrictions. An app may be able to access protected user data.

Pi-hole, a DNS sinkhole system, has a vulnerability in shell scripts that perform file operations with root privileges without validating paths. An attacker with Pi-hole privileges can exploit this flaw to escalate privileges to root by manipulating SSH keys.

A path handling issue was addressed with improved logic. An app may be able to observe unprotected user data.

The issue was addressed with improved memory handling. Exploitation of this vulnerability may lead to process memory corruption when processing a maliciously crafted image.

An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the js_mapped_arguments_mark function.

A logic issue was addressed with improved restrictions. This issue affects Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) and may allow a malicious app to break out of its sandbox.

An out-of-bounds read was addressed with improved bounds checking in Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS). An app may be able to cause a denial-of-service.