CVE Vulnerability Catalog

In liweiyi ChestnutCMS up to 1.5.8, the resourceDownload function in /dev-api/common/download is vulnerable to path traversal via manipulation of the path argument. The attack can be launched remotely, and the exploit is publicly available.

A flaw has been found in qianfox FoxCMS up to 1.2.16. Affected by this vulnerability is the function add/edit of the file app/admin/controller/Product.php. Manipulation of the argument Title causes cross-site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early but did not respond.

In EverShop up to 2.0.1, manipulation of the uuid argument in Order.resolvers.js of the Order Handler component results in improper control of resource identifiers. The attack can be performed remotely, is of high complexity and difficult exploitability, and the exploit is public.

A security flaw has been discovered in Skuul School Management System up to 2.6.5. The impacted element is an unknown function of the file /dashboard/fees/fee-invoices/ of the component View Fee Invoice. Manipulation of the argument invoice_id results in improper control of resource identifiers. Remote exploitation is possible, but the attack is considered high complexity and difficult to exploit. The exploit has been released publicly and may be exploited.

In newbee-mall-plus up to 2.4.1, the executeSeckill function at /seckillExecution/ mishandles the userid argument, leading to authorization bypass. The attack can be initiated remotely, is considered high complexity and difficult to exploit, and the exploit is publicly available.

Vercel's AI SDK has a vulnerability that allows bypassing filetype whitelists when uploading files. The issue is fixed in versions 5.0.52, 5.1.0-beta.9, and 6.0.0-beta.

Use-after-free vulnerability in V8 in Google Chrome prior to 141.0.7390.54. A remote attacker can potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low)

Samsung Email prior to version 6.2.06.0 has improper input validation. It allows local attackers to launch arbitrary activities with Samsung Email privileges.

A permissions issue was addressed with additional restrictions. The vulnerability affects iOS 18.7.2 and iPadOS 18.7.2, and iOS 26.1 and iPadOS 26.1. An app may be able to identify what other apps a user has installed.

A logging issue was addressed with improved data redaction. The vulnerability affects iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Tahoe 26.1, and visionOS 26.1. An attacker with physical access to an unlocked device paired with a Mac may be able to view sensitive user information in system logging.

A vulnerability in macOS allows an attacker with physical access to access contacts from the lock screen. The issue was addressed by restricting options offered on a locked device. It is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and macOS Tahoe 26.1.

This issue was addressed with improved handling of symlinks and is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, and macOS Tahoe 26.1. An app may be able to access protected user data.

A denial-of-service issue was addressed with improved input validation. The vulnerability affects iOS 18.7.2 and iPadOS 18.7.2, and iOS 26 and iPadOS 26. An unprivileged process may be able to terminate root processes.

A permissions issue was addressed with additional restrictions. The vulnerability affects iOS 26.1 and iPadOS 26.1. An attacker may be able to view restricted content from the lock screen.

A logic issue was addressed with improved checks. The vulnerability affects iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen.

A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java of the component Authentication Token Handler. Such manipulation leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

A vulnerability was detected in PHPGurukul News Portal 1.0 affecting an unknown function in /onps/settings.py. Manipulation results in insertion of sensitive information into debugging code. The attack can be initiated remotely, but its complexity is rated as high and exploitability as difficult. The exploit is now public and may be used.

In LogicalDOC Community Edition up to 9.2.1, the admin login page (/login.jsp) lacks proper restriction of excessive authentication attempts. The attack has high complexity and is difficult to exploit, but a public exploit is available.

LogicalDOC Community Edition up to 9.2.1 has a cross-site scripting (XSS) vulnerability in the API Key creation UI. The attack can be performed remotely, and the exploit has been publicly disclosed.

IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.