CVE Vulnerability Catalog

A permissions issue was found in Apple systems and fixed with additional restrictions. A local app may be able to read a persistent account identifier.

A privacy issue was found in Apple systems and fixed by removing sensitive data. An app may be able to bypass certain Privacy preferences.

An information disclosure issue was addressed with improved state management. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. An app may be able to identify what other apps a user has installed.

An information disclosure issue in Apple systems was addressed with improved memory management. An app may be able to disclose kernel memory.

This issue was addressed with improved redaction of sensitive information. It is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.8, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, and watchOS 26.6. An app may be able to disclose kernel memory.

IBM i versions 7.6, 7.5, 7.4, and 7.3 contain a buffer overflow in a PASE process that can lead to denial of service. An authenticated attacker could leverage this to terminate their own process.

IBM WebSphere Application Server 9.0 and 8.5 is affected by an authorization bypass vulnerability. The flaw allows access to resources without required permissions.

In cosmicstack-labs mercury-agent up to 1.2.0, the PermissionManager.checkShellCommand function in mercury-agent/src/capabilities/permissions.ts (Shell Permission Manifest component) can lead to information disclosure via manipulation. The attack is restricted to local execution and the exploit is publicly available.

OpenZeppelin Contracts Wizard prior to @openzeppelin/wizard 0.10.11, wizard-cairo 3.0.1, wizard-stellar 0.6.2, and wizard-stylus 0.3.1 prints info.securityContact and info.license verbatim into single-line comments in generated source. A line terminator ends the comment, causing following input to be emitted as source declarations.

SpiceDB from 1.34.0 until 1.54.0 can return PERMISSIONSHIP_HAS_PERMISSION instead of PERMISSIONSHIP_CONDITIONAL_PERMISSION or PERMISSIONSHIP_NO_PERMISSION because checkRequestToKey() and checkRequestToKeyWithCanonical() in internal/dispatch/keys/computed.go omit CheckHints when constructing dispatch Check cache keys. A result computed for one hint set can poison the cache entry used by a semantically different authorization check.

October CMS versions prior to 3.7.17 and 4.2.21 contain a PHP object injection vulnerability in the system module. The backend `SessionMaker` trait stored widget session state as `base64(serialize(...))` and consumed it with `unserialize()` without an `allowed_classes` restriction, allowing attacker-controlled bytes to trigger object injection and reachable PHP gadget chains. This issue only affects installations with `cms.safe_mode` enabled, which is an opt-in feature for demo or multi-tenant scenarios.

A vulnerability in the October CMS system module's Twig sandbox security policy allowed a chained bypass when cms.safe_mode is enabled. By combining unrestricted access to the Laravel session store with unblocked raw SQL methods reachable through Eloquent's __call forwarding, a backend user with CMS markup editing access could read arbitrary database values and write to the backend authentication session key, forging a session as another existing user. The issue is patched in versions 3.7.17 and 4.2.21.

fluent-plugin-s3 from 0.7.0 to 1.8.4, the in_s3 input plugin reads the entire decompressed payload of gzip, lzma2, and lzop objects into memory without enforcing a decompression_size_limit. An attacker with permission to upload objects to the monitored S3 bucket can provide a highly compressed object that expands excessively.

In Nimiq (Rust implementation) before version 1.6.0, a vulnerability allows a malicious state-sync peer to crash a syncing node by sending a crafted TrieChunk proof causing an out-of-bounds panic.

In Nimiq (Rust) before 1.6.0, a vulnerability allows a malicious state-sync peer to crash a node by sending a TrieProof with duplicate keys, leading to a panic due to improper handling of None.

In vLLM up to 0.29.0, a vulnerability in the TiktokenTokenizer::new function (rust/src/text/src/backend/hf/mod.rs) leads to DoS via local manipulation.

A vulnerability in SourceCodester Inventory Management System 1.0 affects an unknown functionality of the file /api/products_handler.php of the Product Management Module. Manipulation of the Product_Name argument leads to cross site scripting. The attack may be performed remotely, and the exploit has been publicly disclosed.

A vulnerability in SourceCodester Inventory Management System 1.0 affects an unknown functionality of the file /api/vendors_handler.php of the Vendor Management component. Manipulation results in cross site scripting. The attack is possible to be carried out remotely, and the exploit has been made public.

A vulnerability in SourceCodester Inventory Management System 1.0 affects an unknown function of the file /api/customers_handler.php of the Customer Management Module. Manipulation of the Customer_Name argument leads to cross site scripting. The attack can be executed remotely, and the exploit has been disclosed to the public.

In Mbed TLS 3.6.x before 3.6.7 and 4.1.x before 4.1.2, the TLS 1.3 client accepts a HelloRetryRequest selecting a group that was not advertised. This can violate TLS 1.3 protocol negotiation expectations.