CVE Vulnerability Catalog

A vulnerability was detected in GNU Binutils 2.47 in the function elf_x86_64_common_section_index in bfd/elf64-x86-64.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GNU Binutils 2.47 in the function elf_link_add_object_symbols in bfd/elflink.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GNU Binutils 2.47 in the function _bfd_elf_eh_frame_section_offset in bfd/elf-eh-frame.c, leading to a null pointer dereference. The attack requires local access, and the exploit is public.

A vulnerability was detected in GPAC up to f1219cde in the function gf_node_activate_ex in scenegraph/base_scenegraph.c, leading to a stack-based buffer overflow. The attack requires local access, and the exploit is public.

The Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. A malicious application installed on the user's Android device may exploit the affected component via an Intent, potentially allowing the malicious application to obtain sensitive information from the affected application.

The WP Directory Kit WordPress plugin through version 1.5.7 does not check authorization or listing visibility in one of its shortcodes. This allows users with a role as low as Contributor to disclose non-public listing content, including password-protected and hidden fields, belonging to other users.

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/Login_Model.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext storage in a file or on disk. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks.

A vulnerability was found in itranswarp up to version 2.19 in the Markdown.toHtml function of Markdown.java, used for page content rendering. This manipulation causes cross-site scripting (XSS). The attack may be initiated remotely and the exploit has been published.

An authenticated supplicant on an adjacent network may bypass the intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of authentication and full enforcement of its assigned ACL.

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. This may lead to incorrect enforcement of access policy.

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.

A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement.

A vulnerability was identified in GPAC 26.07.0 in the gf_node_deactivate_ex function of scenegraph/base_scenegraph.c in the MP4Box component. This manipulation leads to use after free. The attack must be carried out locally and the exploit is publicly available.

A vulnerability was determined in GPAC 26.07.0 in the gf_node_del function of scenegraph/base_scenegraph.c in the MP4Box component. This manipulation causes an out-of-bounds read. The attack is restricted to local execution and the exploit has been publicly disclosed.

A vulnerability was found in GPAC 26.07.0 in the gf_node_unregister function of scenegraph/base_scenegraph.c in the MP4Box component. The manipulation results in use after free. The attack is only possible with local access and the exploit has been made public.

A vulnerability has been found in GPAC 26.07.0 in the gf_sg_dom_event_bubble function of src/scenegraph/dom_events.c in the MP4Box component. The manipulation leads to a stack-based buffer overflow. The attack can only be performed from a local environment and the exploit has been disclosed to the public.

A permissions issue was addressed with additional restrictions. The issue affects iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27. An app may be able to read device name.

An authorization issue was addressed with improved state management. The issue affects macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, and watchOS 27. An app may be able to access Bluetooth device information.