CVE Vulnerability Catalog

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker with remote access could exploit it to cause information disclosure, protection mechanism bypass, SSRF, and unauthorized access.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Authorization Bypass Through User-Controlled Key vulnerability. A low-privileged attacker with remote access could exploit it to achieve elevation of privileges.

In Bouncy Castle for Java LTS before 2.73.13, the native one-shot CTR packet cipher did not check that the requested input length fitted the counter space left by the IV. With a 13- to 15-byte IV the counter is only 1 to 3 bytes, so for longer input the counter wrapped and the keystream repeated from the start of the same packet. The call still returned the full input length as though every byte had been correctly transformed, with no exception and no short length.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could exploit it to cause denial of service, information disclosure, and remote execution.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Inclusion of Functionality from Untrusted Control Sphere vulnerability. A low-privileged attacker with remote access could exploit it to achieve elevation of privileges, filesystem access, and remote execution.

Dell Secure Connect Gateway (SCG) Policy Manager versions prior to 5.34.00.16 contain an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could exploit it to achieve elevation of privileges, protection mechanism bypass, and unauthorized access.

The elixir-protobuf library in versions from 0.8.0 before 0.17.1 contains an uncontrolled recursion vulnerability in Protobuf.JSON.Decode. An unauthenticated remote attacker can crash the decoding process via a deeply nested JSON document when the schema contains a self-referential or cyclic message type.

A vulnerability in Zephyr RTOS affects the user-mode verification handler z_vrfy_device_deinit() in kernel/device.c, which validated its dev argument with K_SYSCALL_OBJ_INIT(dev, K_OBJ_ANY). Because k_object_validate() short-circuits type comparison for K_OBJ_ANY, the check only verified that the pointer was the base address of some kernel object the calling thread was granted, without comparing the object's actual type. This allows a local user-mode thread to pass a thread stack object (e.g., from k_thread_stack_alloc()) and achieve supervisor-mode kernel code execution.

In the ARM64 MMU back-end of Zephyr RTOS, address space identifiers (ASIDs) are assigned by a bare round-robin counter, which after wrapping past 255 possible values can hand the same ASID to a new domain while a still-live domain holds it. Because domain-private mappings are installed as non-global (MT_NG), the ASID is the only tag separating cached translations in the TLB, and the context-switch path does not flush the TLB for a duplicate reached through a third domain. As a result, user-mode threads in one domain can read and write memory belonging to another domain, defeating memory-domain isolation.

A vulnerability in the LE Audio Broadcast Sink (subsys/bluetooth/audio/bap_broadcast_sink.c) allows an attacker in radio range to write data beyond the bounds of the static mod_src_param structure in .bss. Missing size checks when copying subgroup metadata from a BASE frame leads to a buffer overflow, potentially enabling remote code execution in the Bluetooth RX thread.

A vulnerability in the Zephyr RTOS kernel allows an unprivileged user-mode thread to perform an out-of-bounds write in kernel memory. It stems from missing overflow checks when calculating allocation sizes for dynamic kernel objects, leading to undersized heap allocations. An attacker can exploit this to escalate privileges and execute arbitrary code at the kernel level.

In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin.

In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an authenticated user, including a low-privilege or guest account with a valid bearer token, to register as a trusted service agent. On the next server settings-synchronization event, the rogue agent receives storage settings and encryption private keys.

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection. This issue affects WP Rocket: from n/a before 3.23.5.

The FooSales WordPress plugin before 1.43.3 does not verify that an authenticated caller is entitled to act as the user named in a request. Any authenticated user can make the plugin act as an arbitrary other user, including an administrator, exposing that user's account details and leading to account takeover.

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display.

The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature. This allows users with the plugin's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archive. This vulnerability is mitigated by the fact that an export must have been previously requested by someone with the "Synchronize, import, and export configuration" permission. NOTE: CVE-2026-107914 refers to the vulnerability in which config.admin.inc does not ensure that a file_unmanaged_delete operation occurs, so many archives could persist.

A type confusion vulnerability in the _read_flags function (src/commands/cmd_dispatcher.c) in FalkorDB before 4.20.0 allows a remote authenticated attacker who can run GRAPH.QUERY to cause a denial of service and possibly disclose or corrupt memory. The function accepts a --bolt argument from any client and casts the following command argument, a Redis string object, to a Bolt client structure without checking its origin; the result-set code then dereferences pointers read from that object. The argument is parsed even when the Bolt endpoint is disabled, so default configurations are affected.

An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to execute graph queries without credentials through the Bolt endpoint. The function decides whether a password is required by issuing an empty AUTH command to Redis and treats only a WRONGPASS error as meaning that a password is required; any other error, such as LOADING while a dataset is being loaded, MASTERDOWN during replication failover, or OOM under memory pressure, causes the client to be treated as authenticated. Only deployments that enable the Bolt endpoint (BOLT_PORT, disabled by default) are affected.