CVE Vulnerability Catalog

The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA for a given user. The response contains only a bare boolean validation indicator with no cryptographic artifact, resulting in an unverifiable authentication verdict being delivered to the relying application.

The Okta Verify for Windows uninstaller does not verify whether the user data directory is a filesystem junction before deleting its contents with elevated privileges. The delete operation follows the junction target, resulting in recursive deletion of unintended directory contents.

The MaonoAiServices Windows service in Maono Link 3.8.13 allows local privilege escalation for a standard user account due to improper write privileges in 'C:\ProgramData\Maono'. Fixed in version 4.0.80.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

A memory corruption vulnerability exists in FFmpeg before 8.1 in the RTP encoding process. In the nal_send function in libavformat/rtpenc_h264_hevc.c, a negative size parameter (size=-3) is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using AddressSanitizer.

IBM Enterprise Build of Quarkus versions 3.27.1 through 3.27.5 and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input.

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, and an optional token introspection cache is enabled, a valid token issued by one OIDC provider can also be used to access an endpoint secured by another OIDC provider.

A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of the file Core/Controller.php of the component Controller. Performing a manipulation results in improper authentication. The attack may be initiated remotely. Upgrading to version 1.10.0 is sufficient to resolve this issue.

A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_handler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 20260819.01 is sufficient to fix this issue.

A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is recommended to address this issue.

In the current development version of Eclipse aeriOS (no official release yet), the Identity Manager (IdM) deployment included insecure default configurations and credentials for security-sensitive services. The Helm chart exposed Keycloak and its PostgreSQL backing database through Kubernetes NodePort services by default, while Docker Compose exposed PostgreSQL on all network interfaces. The deployment included fixed default credentials for the Keycloak administrator and PostgreSQL user, plus predefined application users with known credentials.

HTML::FormHandler before version 0.410002 for Perl renders field attributes into HTML without escaping using the process_attrs method. Applications with fields or labels where attributes are built from data rather than literals may allow attacker-influenced text in attribute values, potentially overriding field attributes or embedding JavaScript in rendered pages.

HTML::FormHandler before version 0.410002 for Perl renders some error messages into HTML without escaping. The Table form layout and Bootstrap 2 and 3 wrappers splice each error string directly into the surrounding markup. Error messages containing attacker-influenced content such as rejected field values could embed JavaScript in rendered pages.

HTML::FormHandler before version 0.410002 for Perl renders option group labels and radio button labels into HTML without escaping. The Select, RadioGroup, CheckboxGroup and HorizCheckboxGroup widgets render a group label unescaped, and RadioGroup also renders each radio button's own label unescaped. Applications whose option list is built from data may allow attacker-influenced text in a label, potentially overriding options or embedding JavaScript.

Improper input validation in the Vega expression function implementation in OpenSearch Dashboards allows a remote authenticated actor with dashboard write permissions to execute arbitrary JavaScript in the context of other users' browser sessions by saving a crafted Vega visualization. The checkForFunctionProperty validation routine failed to recurse into arrays of objects, allowing a function property nested inside an array to bypass validation.

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket. Certificate chain and hostname validation are disabled for every wss:// connection, with no builder option, constructor argument, or environment variable to enable it. An attacker intercepting the connection can present an arbitrary certificate, complete the TLS handshake, read credentials sent in the Authorization header, and read, alter, or inject Ditto Protocol messages.

Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.