CVE Vulnerability Catalog

An out-of-bounds access issue in Apple systems was addressed with improved bounds checking. The issue affects iOS 26, iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, and watchOS 26. An app may be able to cause unexpected system termination.

An issue existed in the handling of environment variables and was addressed with improved validation. The flaw affects iOS 26.1, iPadOS 26.1, macOS Tahoe 26, tvOS 26.1, and watchOS 26.1. An app may be able to access sensitive user data.

feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows a "kubectl version; kubectl delete pod" command because the first word (i.e., "version") is not a write or delete operation.

Mattermost versions 10.5.x <= 10.5.9 fail to properly validate redirect URLs, allowing attackers to redirect users to malicious sites via crafted OAuth login URLs.

A vulnerability was identified in IbuyuCMS up to 2.6.3 in an unknown function of the file /admin/article.php?a=mod within the Add Article Page component. Manipulation of the Title argument leads to cross site scripting, and the attack can be carried out remotely. The exploit is publicly available and might be used.

In newbee-mall 1.0, the mallKaptcha function in /common/mall/kaptcha produces a guessable captcha. The attack can be executed remotely, is of high complexity and difficult exploitability, and the exploit is publicly available.

Due to a bug in the Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them. This may lead to unauthorized disclosure of host prototype information.

A vulnerability was found in openDCIM 23.04 affecting unknown code of the file /scripts/uploadifive.php within the SVG File Handler component. Manipulation of the Filedata argument leads to cross site scripting, and the attack can be launched remotely. The exploit has been disclosed to the public and may be used; the vendor did not respond.

A cross-site scripting (XSS) vulnerability was found in Scada-LTS up to version 2.7.8.1 in the /reports.shtm file of the Reports Module component. Manipulating the Colour argument leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.

A cross-site scripting (XSS) vulnerability was detected in Scada-LTS up to version 2.7.8.1 in the /data_point_edit.shtm file of the Data Point Edit Module component. Manipulating the Text Renderer properties leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.

A vulnerability in the diagnostic component of AxxonSoft Axxon One VMS (C-Werk) versions 2.0.0 through 2.0.1 on Windows allows a local attacker to obtain licensing-related information such as timestamps, license states, and registry values by reading diagnostic export files created by the built-in troubleshooting tool.

A flaw was found in libssh's handling of key exchange (KEX) processes when a client repeatedly sends incorrect KEX guesses. The library fails to free memory during these rekey operations, which can gradually exhaust system memory, leading to crashes on the client side, particularly when using libgcrypt.

The Compress & Upload WordPress plugin before version 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup).

A cross-site scripting (XSS) vulnerability was identified in SourceCodester Simple To-Do List System 1.0 in the /fetch_tasks.php file of the Add New Task component. Injecting a malicious script via input can lead to code execution in the user's browser. The exploit has been publicly disclosed.

Portabilis i-Educar up to 2.10 contains a cross-site scripting vulnerability in /intranet/educar_usuario_cad.php (user edit page). Manipulating the email/data_inicial/data_expiracao arguments allows remote XSS attacks, and a public exploit is available.

RICOH Streamline NX versions 3.5.1 to 24R3 are vulnerable to tampering with operation history. If an attacker can perform a man-in-the-middle attack, they may alter the values of HTTP requests, which could result in tampering with the operation history of the product's management tool.

Portabilis i-Educar up to 2.10 contains a cross-site scripting vulnerability in /usuarios/tipos/. Manipulating the Tipos de Usuário/Descrição arguments allows remote attacks, and the exploit is publicly available.

ImageMagick versions lower than 14.8.2 include insecure functions SeekBlob() and WriteBlob() that allow a heap write beyond the allocated memory when the offset is large. The vulnerability does not require external delegates or policy settings. It is fixed in version 14.8.2.

IBM Sterling B2B Integrator (versions 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4) and IBM Sterling File Gateway (same version ranges) could disclose sensitive system information about the server to a privileged user. The disclosed data could aid in further attacks against the system.

BoomCMS v9.1.4 from UXB London contains a Cross-Frame Scripting (XFS) vulnerability, a web attack technique exploiting browser bugs to spy on users via JavaScript. The attack relies on social engineering and depends on the user's browser; it only works in older browsers.