CVE Vulnerability Catalog

A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617, affecting an unknown function in the file /dm/dispatch/userinfo/upload. Manipulation of the File argument results in unrestricted upload. The attack can be initiated remotely, and the exploit is public.

A buffer overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the Alarm/Conditions wrapper when processing PublishResponse EventNotificationList data.

A buffer overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the LockedStaMac_ProcessMsg_DeleteMonitoredItemsResponse and SOPC_StaMac_NewDeleteMonitoredItems functions in the client wrapper DeleteMonitoredItems path.

In open62541 1.5.5, a server-side use-after-free exists in the local MonitoredItem callback path. The issue occurs when UA_Subscription_localPublish continues to use the current UA_Notification after a callback invokes UA_Server_deleteMonitoredItem for the current local MonitoredItem. This allows a remote attacker to cause a denial of service.

NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0. Attackers can cause denial of service via a dataset with 'defined' flag and negative size field.

Nuxt is an open-source web development framework for Vue.js. From 3.1.0 until 3.21.10 and 4.5.1, the internal island renderer endpoint `/__nuxt_island/...` decodes and hashes attacker-controlled JSON body input with destr and ohash before validating the URL-resident hash. An unauthenticated `POST /__nuxt_island/_.json` with a large JSON body is fully read, parsed, hashed, and then rejected, which wastes CPU on Nitro single event loop and delays concurrent requests. No valid hash and no authentication are required. This issue is fixed in 3.21.10 and 4.5.1.

Nuxt is an open-source web development framework for Vue.js. From 3.4.0 until 3.21.10 and 4.5.1, an attacker can inject a template key through /__nuxt_island/ props into a dynamic component when `vue.runtimeCompiler: true` is enabled, causing template execution in the Nitro process. This issue is fixed in 3.21.10 and 4.5.1.

Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be returned before route middleware and page guards because import.meta.prerender is not enforced, disclosing another user's SSR data. This issue is fixed in 4.5.1.

S2OPC 1.7.3 contains an out-of-bounds read in RepublishResponse handling, allowing a remote attacker to cause a denial of service.

An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component.

SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the requesting user is authorized to access the target user's data.

Nuxt is an open-source web development framework for Vue.js. From 3.21.7 until 3.21.10 and 4.5.1, mixed-case routeRules keys can fail to match case-folded lookups when router.options.sensitive is false and drop appMiddleware authorization gates. This is caused by an incomplete fix for CVE-2026-53721. This issue is fixed in 3.21.10 and 4.5.1.

Nuxt, an open-source web development framework for Vue.js, contains a vulnerability allowing an unauthenticated attacker to trigger unbounded SSR memory allocation via the v-for prop in server islands, potentially crashing the Nuxt process. Affects versions from 3.1.0 to 3.21.10 and 4.5.1; fixed in 3.21.10 and 4.5.1.

rclone, a command-line program for syncing files with cloud storage, has a vulnerability where SFTP paths are interpolated into PowerShell commands, allowing an attacker-controlled filename to execute arbitrary PowerShell statements as the victim SSH account. Affects versions prior to 1.75.0; fixed in 1.75.0.

rclone serve restic fails to properly reject URL paths beginning with ../, allowing an attacker with REST endpoint access to read, create, overwrite, or delete objects outside the configured directory. Affects versions from 1.40.0 to 1.75.0; fixed in 1.75.0.

Gitea prior to 1.27.0 contains a Server-Side Request Forgery (SSRF) vulnerability allowing authenticated attackers to bypass SSRF protections and access internal services, cloud instance metadata endpoints, or read local files such as application configuration with database credentials and signing secrets. Attackers can exploit HTTP fetch operations in migration and OAuth avatar code paths.

KARR Security System and SWDS dealer-installed automotive anti-theft systems use a shared Bluetooth authentication key across affected devices. An attacker within Bluetooth range can issue unauthorized commands to the vehicle, potentially allowing unauthorized access to vehicle functions, including door unlocking and engine immobilization.

Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.

GitHub Enterprise Server before version 3.21 contains a denial of service vulnerability that allows an unauthenticated attacker to cause excessive CPU consumption and exhaust the pool of request-handling worker processes by sending a crafted form-encoded HTTP POST request with deeply nested parameters. The vulnerability was fixed in versions 3.20.3, 3.19.7, 3.18.10, and 3.17.16.

Spacebar Server before commit dcfd910 contains a missing authorization vulnerability allowing any authenticated attacker to add themselves to arbitrary group DM channels by sending a PUT request to the channels recipient endpoint without membership verification. Attackers can join private group DMs, read complete message history, post messages as a participant, and force-add third-party users without consent.