CVE Vulnerability Catalog

In filelock from 4.0.0 until 4.2.1, SoftReadWriteLock refreshed holder records by name. Another local user with rename access to the lock directory could replace a record with a named pipe and stall the lock, or under a permissive hard-link policy link a reachable target file and cause the lock user to write through it.

In filelock from 3.20.4 until 4.2.1, ReadWriteLock could open a crafted SQLite lock database without bounding schema and query work. Another local user who can replace the database could make acquisition stall or hang.

In filelock from 4.1.0 until 4.2.1, SoftFileLock could restore a stale marker by name after moving it aside. Another local user with rename access in a non-sticky lock directory could swap in a symbolic link and, on a runtime that follows the link and a same-filesystem target, make the lock user hard-link one of its files into the lock directory.

In filelock from 3.30.0 until 4.2.1, StrictSoftFileLock (from 3.30.0) and SoftReadWriteLock (from 4.0.0) could adopt a protocol directory created first by another local user in a shared parent directory. This allowed that user to alter protocol state and admit concurrent holders.

filelock before 4.2.1 has a vulnerability in UnixFileLock that can truncate a regular file renamed onto the lock path when another local user has rename permission or hard-linked there under a permissive policy. When an explicit mode is requested, versions from 3.10.2 can also change that file's mode.

filelock from 4.1.0 to 4.2.1 has a vulnerability in SoftFileLock that can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, and coarse or matching modification times preserve the observation. This can cause a live marker to be removed as stale.

The Seriously Simple Podcasting WordPress plugin through 3.17.0 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Seriously Simple Podcasting WordPress plugin through 3.17.0 contains a stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

A2A Java SDK before 1.3.0.Final has a vulnerability in RestHandler.parseRequestBody that logs the entire JSON request body at SEVERE level when protobuf parsing fails. With push notifications enabled, this can expose tokens and authentication credentials in server logs.

A2A Java SDK before 1.3.0.Final has a vulnerability in BasePushNotificationSender that sends task data to a URL without destination validation, scheme restrictions, or redirect limits. An unauthenticated attacker can register an arbitrary destination, causing the server to send requests to internal or local resources.

The USBX host stack has a vulnerability where HID report descriptor parsing checks item size only after advancing past the header and parsing the payload, and does not compare declared sizes against actual received bytes. A HID peripheral returning a short report descriptor causes a heap out-of-bounds read during ordinary enumeration.

The USBX host stack has a vulnerability in the VideoStreaming interface where the wTotalLength field is used as a budget for walking descriptors without validating against the actual received configuration descriptor size. A device reporting a larger wTotalLength than supplied descriptors causes an out-of-bounds read of the configuration buffer.

Execution After Redirect (EAR) vulnerability in Apache Tomcat. Affects versions 11.0.0-M1 through 11.0.26, 10.1.0-M1 through 10.1.60, and 9.0.0.M1 through 9.0.122; EOL versions 8.5.0-8.5.100 and 7.0.0-7.0.109 are also known to be affected.

Not Failing Securely ('Failing Open') vulnerability in Apache Tomcat: if OpenSSLLifecycleListener is configured for FIPS mode but FIPS activation fails, Tomcat logs an error but continues using JSSE in non-FIPS mode with the provided configuration. Affects versions 11.0.0-M14 through 11.0.26, 10.1.22 through 10.1.60, and 9.0.92 through 9.0.122.

DrayTek Vigor2960 version 1.5.1.6 Revision 8218 has a vulnerability in /cgi-bin/mainfunction.cgi in the commonupload component, allowing unrestricted file upload via manipulation of upload_path/upload_name arguments. The attack can be performed remotely and the exploit has been publicly disclosed.

Nokia 1830 Global Express GX is vulnerable to a local privilege escalation vulnerability in the administrative shell interface. An authenticated local attacker with restricted shell access can exploit this to bypass local security restrictions and gain root access on the device.

Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on October 17, and the list was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. The vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, Firefox ESR 115.43.1, Thunderbird 158.0.1, and Thunderbird 153.5.1.

A denial-of-service vulnerability exists in the PDF Viewer component. The vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

An uninitialized memory vulnerability in the Audio/Video: cubeb component of Firefox and Thunderbird. The issue was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

A reflected cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation was found in the Ticimax E-Commerce Platform. The issue affects versions through 2026-09-02.