CVE Vulnerability Catalog

In Eclipse BaSyx Java Server SDK prior to version 2.0.0-milestone-10, the Operation Delegation feature fails to validate the destination URI. An unauthenticated attacker can force the BaSyx server to execute blind HTTP POST requests to arbitrary internal or external targets, bypassing network segmentation.

W jądrze systemu Linux zidentyfikowano podatność związaną z operacją BPF_END, która nieprawidłowo nie resetuje identyfikatora rejestru. To może prowadzić do błędnych wniosków o wartościach rejestrów, co stwarza ryzyko dostępu do pamięci poza dozwolonym zakresem.

W jądrze systemu Linux zidentyfikowano podatność, która została naprawiona. Problem dotyczy funkcji xfs_attri_recover_work, gdzie po błędzie w iget nie ustawiano wskaźnika @ip na poprawny adres, co prowadziło do dereferencji wiszącego wskaźnika.

W jądrze Linuxa naprawiono podatność związana z Bluetooth w funkcji l2cap_ecred_reconf_rsp(). Problem polegał na błędnym rzutowaniu danych, co prowadziło do odrzucania poprawnych pakietów oraz zwracania nieprawidłowych danych.

In the Linux kernel netfilter nft_ct module, packets pending in nfqueue were not dropped on removal of dependent objects. These packets may hold references to conntrack zone templates, timeout policies, and helpers that can be removed, leaving stale references.

In the Linux kernel, a list corruption and use-after-free issue in Bluetooth MGMT command complete handlers was fixed. Incorrect use of mgmt_pending_valid() led to a double list_del() and freeing of in-flight mesh commands.

In the Phoenix (Elixir) long-poll transport, a POST request with Content-Type application/x-ndjson splits the request body on newline characters without limiting the number of segments. A body consisting entirely of newline bytes causes massive memory amplification and BEAM resource exhaustion, crashing the node and terminating sessions.

There is an OS command injection vulnerability in the traceroute diagnostic handler in the ALTICE LABS / SFR France GR140DG Fibre Router. Unsanitized user input is inserted into a system() call, allowing authenticated remote attackers to execute arbitrary commands as root.

There is an OS command injection vulnerability in the ping diagnostic handler in ALTICE LABS / SFR France GR140DG Fibre Router. Due to improper handling of user input in the system() call, authenticated remote attackers can execute arbitrary commands.

An issue was discovered in Samsung Mobile Processors, including Exynos 980, 990, 850, 2100, and modems 5123 and 5300, related to incorrect handling of 5G NR NAS registration accept messages, leading to Denial of Service.

The WeePie Cookie Allow plugin for WordPress is vulnerable to SQL Injection via the 'consent' parameter in all versions up to and including 3.4.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access control checks on the write_mem (ioctl 0x89F5) and read_mem (ioctl 0x89F6) debug handlers, which are compiled into production builds via the unconditionally defined _IOCTL_DEBUG_CMD_ macro in 8192cd_cfg.h.

W Apache HTTP Server w module mod_md występuje podatność związana z alokacją zasobów bez ograniczeń lub throttlingu, która dotyczy danych odpowiedzi OCSP. Problem ten wpływa na wersje od 2.4.30 do 2.4.66.

A weakness has been identified in EFM ipTIME C200 up to version 1.092, affecting the function sub_408F90 of the file /cgi/iux_set.cgi of the ApplyRestore Endpoint component. Manipulation of the argument RestoreFile leads to command injection.

A security flaw has been discovered in IObit Advanced SystemCare 19, affecting an unknown part of the file ASC.exe of the component Service. The manipulation results in symlink following, requiring local attack.

In Eclipse Open9J versions 0.21 to 0.58, a pre-authentication remote attacker can crash JITServer by sending a 32-byte crafted TCP message.

The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 28.4. This is due to the upload_icons() function workflow moving and unzipping user-controlled ZIP files into a public uploads directory without validating extracted file types.

OpenClaw before version 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets.

OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious workspace plugins that bypass intended trust gates during setup-time plugin loading.

OpenClaw before 2026.4.9 contains an authentication bypass vulnerability allowing untrusted workspace plugins to be auto-enabled during non-interactive onboarding when provider auth choices are shadowed. Attackers can exploit this by crafting malicious workspace plugins that are automatically selected and enabled during authentication setup without explicit user consent.