CVE Vulnerability Catalog

A vulnerability in Safari was addressed with improved checks. Visiting a maliciously crafted website may leak sensitive data.

An information leakage was addressed with additional validation. This vulnerability affects Apple systems and may allow an app to leak sensitive kernel state.

A use-after-free vulnerability in Safari was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process crash.

Onyx is an open-source AI platform. Prior to 4.3.0, the Enterprise Edition lacks enforcement of curator permission validation in the PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints, allowing a curator to add accounts to arbitrary groups and gain document access. This is fixed in version 4.3.0.

9Router in 0.5.4 and earlier does not restrict the issuerUrl parameter in the POST /api/auth/oidc/test endpoint, allowing unauthenticated attackers (when dashboard login is disabled) to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

A vulnerability in the Trueview T18061 WiFi 3MP Robot Pan-Tilt security camera allows a physically proximate attacker to escalate privileges via the RSA private key component.

Dokploy is a free, self-hostable PaaS. Prior to 0.29.6, the user update procedure does not delete other session rows after a password change, allowing a compromised session token to remain valid for up to three days. This is fixed in version 0.29.6.

Dokploy prior to 0.29.6 allows a user with member:create permission to invite an account with the owner role, and a privileged self-hosted user can create an account with an arbitrary role, enabling permanent organization takeover because owner roles cannot be demoted.

A vulnerability in Safari was addressed with improved memory handling. Processing maliciously crafted web content may lead to an unexpected Safari crash.

A memory corruption issue was fixed with improved memory handling. The vulnerability affects Safari and Apple systems and was resolved in multiple versions. Processing maliciously crafted web content may lead to memory corruption.

A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An attacker in a privileged network position may be able to cause a denial-of-service.

Mahara before 25.04.5 and 26.04.0 is vulnerable to unauthorized access to internal accounts via Learning Tools Interoperability (LTI) under certain circumstances. This applies to LTI 1.1 and LTI 1.3 Advantage.

The issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to an unexpected Safari crash. The fix is included in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

This vulnerability only affects Grafana stacks with multiple organizations. A user who is an Org Admin of one organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data from other organizations. Disclosed data is limited to dashboard/folder UIDs and permission mappings, not content or personal data.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate WebSocket command field types, allowing an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.

Pandora contains a stored XSS vulnerability in the rendering of URL observables. A malicious URL can be injected into the inline JavaScript onclick handler, allowing arbitrary JavaScript execution in the application context.

Pandora is affected by a stored XSS vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies the file is a PDF but returns it without explicit MIME type, allowing it to be served as HTML or another active format. A crafted PDF/polyglot can execute script in the Pandora application context.

powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories.

SWE-agent's trajectory inspector (sweagent inspector) in v1.1.0 has a path traversal vulnerability in the /trajectory/ handler, allowing unauthenticated network clients to read files outside the intended directory, including JSON files containing repository contents, command output, and secrets.