CVE Vulnerability Catalog

Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Code injection in ReaderMode in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page.

Confused deputy in SignIn in Google Chrome on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page.

Uncontrolled search path element in CredentialProvider in Google Chrome on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Low)

The RabbitMQ Java client library prior to 5.36.0 incorrectly decodes malformed UTF-8 bytes in ValueReader.readShortstr into replacement characters that re-encode beyond the AMQP shortstr limit. An attacker can submit an RPC message with a malformed property, causing an unchecked exception before acknowledgement and repeated message requeueing that disables consumers.

In ImageSharp versions 3.0.0 through 4.1.1, tiled TIFF decoding allocates a destination buffer based on TileWidth while T4, T6, and Modified Huffman decompressors use the full frame width. When TileWidth is smaller than ImageWidth, frame-width fax scanlines are written into a tile-width buffer, causing out-of-bounds writes and heap corruption. The issue is fixed in version 4.1.1.

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.

TP-Link Tapo C500 v2.0 contains an out-of-bounds function-pointer dispatch in its TDP (TP-Link Device Protocol) daemon. A single unauthenticated UDP datagram can cause an invalid indirect call, crashing the main service and resulting in denial of service. No authentication, session, or pairing is required.

NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, bypassing the clean_html sanitizer and auto-exfiltrating the victim's credentials. This enables full account takeover.

In ImageSharp versions 3.0.0 through 4.1.1, decoding a strip TIFF using CCITT Group 3 or Modified Huffman compression can pass attacker-expanded runs to BitWriterUtils.WriteBits without first checking the current row width. T4TiffCompression.WritePixelRun can accumulate oversized makeup-code runs, and ModifiedHuffmanTiffCompression.Decompress validates the width only after writing. The unchecked writes can overflow the strip buffer, corrupt heap memory, and terminate the process. The issue is fixed in version 4.1.1.

In ImageSharp versions 2.1.0 through 4.1.2, the TIFF CCITT Group 4 encoder allocates Width times rowsPerStrip bytes even though T6BitCompressor.CompressStrip can emit encoded row data and two 12-bit end-of-facsimile-block codes beyond that capacity. TiffCcittCompressor.WriteCode performs unchecked writes, and a decode-and-re-encode flow can inherit TiffCompression.CcittGroup4Fax and one-bit metadata from attacker-supplied input. The resulting out-of-bounds writes can corrupt memory and terminate the process. The issue is fixed in version 4.1.2.

In ImageSharp versions 2.0.0 through 4.1.2, decoding an attacker-supplied 32-bit floating-point TIFF as Image<HalfVector4> and applying HistogramEqualization can produce a non-finite or out-of-range luminance in ColorNumerics.GetBT709Luminance. GrayscaleLevelsRowOperation.Invoke uses the resulting value as an unchecked histogram offset, causing an unsafe out-of-range access and process termination. Adaptive Histogram Equalization and AutoLevel are not affected. The issue is fixed in version 4.1.2.

In ImageSharp versions 4.0.0 through 4.1.2, ICC LUT16 conversion accepts more than four output channels even though ClutCalculator.Calculate and LutEntryCalculator.CalculateLut store intermediate and output values in Vector4. When DecoderOptions.ColorProfileHandling is set to Convert, a malformed embedded profile can direct interpolation and output-LUT operations to write one float per declared channel beyond the four-float destination. This can corrupt memory and terminate the process; the default Preserve mode does not run ICC conversion. The issue is fixed in version 4.1.2.

In ImageSharp versions 2.0.0 through 4.1.2, the TIFF CCITT Group 3 encoder allocates an undersized compressed-data buffer for narrow 1-bit images. TiffCcittCompressor.Initialize does not reserve enough space for the row data and T4 end-of-line codes, and T4BitCompressor.CompressStrip reaches unchecked writes when TiffCompression.CcittGroup3Fax is selected directly or inherited from decoded TIFF metadata. An attacker-controlled encode or decode-and-re-encode flow can write beyond the logical output span, corrupt process memory, and terminate the process. The issue is fixed in version 4.1.2.

Quasar Framework prior to 3.3.0, in several @quasar/app-vite SSR and SSG rendering paths, interpolates ssrContext.nonce directly into quoted HTML attributes. An application that derives or overrides this value with attacker-controlled data can allow a quote to terminate the nonce attribute and inject additional attributes or markup into generated HTML. Cryptographically generated base64 or base64url nonces are not affected because they lack HTML attribute delimiters. The issue is fixed in version 3.3.0.

Quasar Framework prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0: renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants could terminate the script element and inject markup. The issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.

Quasar Framework prior to @quasar/ssl-certificate 2.1.0, @quasar/cli 5.0.4, and @quasar/app-vite 3.3.0 caches a combined private key and certificate PEM without explicitly applying owner-only filesystem permissions. Another local user able to read the cache can copy the key and impersonate a development TLS endpoint in an environment that trusts the certificate. The generated certificate was also CA-capable, carried unnecessarily broad key usages, and encoded the IPv6 loopback address as a DNS subject alternative name.

Quasar Framework prior to 2.23.3 passes an unbounded User-Agent request header to getMatch() in Platform.parseSSR(), whose browser-detection expressions combined greedy captures with repeated unbounded scans, causing super-linear backtracking and blocking the Node.js event loop. A crafted unauthenticated request can delay every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected.

Quasar Framework prior to @quasar/icongenie 6.1.1 allows path traversal in the icongenie generate --profile command. Folder and name values from a user-supplied profile are not constrained to the Quasar project directory, allowing parent-directory traversal. A developer running a crafted profile can cause generated image content to be written or overwritten at any path writable by that user, potentially modifying shell startup files, build scripts, or other executable configuration.

Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.