CVE Vulnerability Catalog

A permissions issue was addressed with additional restrictions. The vulnerability affects iOS 26.1 and iPadOS 26.1. An attacker may be able to view restricted content from the lock screen.

A logic issue was addressed with improved checks. The vulnerability affects iOS 26 and iPadOS 26. An attacker with physical access to an iOS device may be able to view notification contents from the Lock Screen.

A vulnerability was identified in fushengqian fuint up to 41e26be8a2c609413a0feaa69bdad33a71ae8032. Affected by this issue is some unknown functionality of the file fuint-application/src/main/java/com/fuint/module/clientApi/controller/ClientSignController.java of the component Authentication Token Handler. Such manipulation leads to authorization bypass. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitation is known to be difficult. The exploit is publicly available and might be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases.

A vulnerability was detected in PHPGurukul News Portal 1.0 affecting an unknown function in /onps/settings.py. Manipulation results in insertion of sensitive information into debugging code. The attack can be initiated remotely, but its complexity is rated as high and exploitability as difficult. The exploit is now public and may be used.

In LogicalDOC Community Edition up to 9.2.1, the admin login page (/login.jsp) lacks proper restriction of excessive authentication attempts. The attack has high complexity and is difficult to exploit, but a public exploit is available.

LogicalDOC Community Edition up to 9.2.1 has a cross-site scripting (XSS) vulnerability in the API Key creation UI. The attack can be performed remotely, and the exploit has been publicly disclosed.

IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic.

QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). The vulnerability is fixed in versions 5.15.19, 6.5.9, and 6.8.2.

The NS Maintenance Mode for WP WordPress plugin through version 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

The Umami Analytics module for Drupal before version 1.0.1 contains a Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.

LiteLLM contains an information disclosure vulnerability in the health API related to the API_KEY parameter. An authenticated remote attacker could disclose sensitive information because the health endpoint improperly exposes data to unauthorized actors. This may lead to leakage of stored credentials and further compromise.

The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, and device serial number, even if a device (such as a Pure Hot+Cool device) has been removed and is not visible in the supported MyDyson app. This could allow an unexpected actor to obtain control and set the room temperature (up to 37 Celsius) if ownership of the device is transferred without wiping the device. NOTE: the Supplier's position is that this is a potential vulnerability that dates back 4 years ago in 2022 and "we are unable to replicate that anymore." Based on the submitted report, in order to leverage this issue, an attacker needs to own a Dyson device with full privileges, sniff for the AWS credentials, and then transfer ownership of that Dyson device to the victim. Even if these steps were successfully accomplished, the attacker only acquires the ability to configure the Dyson device within its safe operating range, and does not acquire the ability to execute code on the device or obtain sensitive information.

The GitHub Workflow Updater VS Code extension before version 0.0.7 stored any provided GitHub token in plaintext in the editor configuration as JSON on disk, rather than using the more secure 'securestorage' API. An attacker with read-only access to the home directory could read this token and use it to perform actions.

A flaw was found in Keycloak. The Keycloak guides recommend not to expose the /admin path to the outside when using a proxy. The issue occurs at least via ha-proxy, as it can be tricked into using relative/non-normalized paths to access the /admin application path relative to /realms, which is expected to be exposed.

A flaw has been found in SourceCodester Student Grades Management System 1.0 in the delete_user function of /admin.php. Manipulation leads to cross site scripting. The attack can be performed remotely and the exploit is publicly available.

A security flaw has been discovered in Willow CMS up to 1.4.0 in the file /admin/articles/add (Add Post Page component). Manipulation of the title/body arguments results in cross site scripting. The attack may be launched remotely and the exploit has been released.

A flaw has been found in PHPGurukul Curfew e-Pass Management System 1.0 in an unknown function of view-pass-detail.php. Manipulation of the Fullname/Category arguments causes cross site scripting. The attack may be initiated remotely and the exploit has been published.

A vulnerability was detected in PHPGurukul Curfew e-Pass Management System 1.0 in an unknown function of edit-category-detail.php. Manipulation of the catname argument results in cross site scripting. The attack can be launched remotely and the exploit is now public.

A vulnerability in PHPGurukul Curfew e-Pass Management System 1.0, affecting an unknown function in the file admin-profile.php. Manipulation of the adminname/email arguments leads to cross-site scripting (XSS). The attack may be launched remotely. The exploit has been published.

A vulnerability was identified in code-projects Client Details System 1.0 in an unknown function of /admin/manage-users.php. Manipulation leads to cross site scripting. The attack can be initiated remotely and the exploit is publicly available.