CVE Vulnerability Catalog

A security vulnerability has been detected in Wavlink WN572, WN570H, WN573, WN529, WN530, WN531, WN535, WN536, WN551, WN557 and NU516 up to 20260609. The function strcpy in upload.cgi of the lighttpd component mishandles the HTTP_COOKIE argument, leading to a stack-based buffer overflow. The attack can be initiated remotely and the exploit has been publicly disclosed.

A weakness has been identified in Razer RzUpdateService 1.10.14.0. The vulnerability affects the Named Pipe Handler component in RzUpdateService.exe. Manipulating the lpThreadParameter argument leads to improper privilege management. The attack requires local access and the exploit has been made public.

A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. The vulnerability affects an unknown function in the AppCheckD.sys library of the Kernel Mini-Filter Driver component, leading to an uncontrolled search path. The attack requires local access, is complex to exploit, and the exploit has been released publicly. The vendor did not respond.

XML::Sig for Perl versions 0.29 through 0.71 allow signature verification bypass. The verify function returns true when every signature was skipped before any cryptographic check. An attacker can supply an XML document with two Signature elements whose URI references a non-existent ID, causing verify to return true without checking the signature.

Telenia Software TVox versions 26.5.3 and prior 26.x, and 24.9.21 and prior 24.x, contain a privilege escalation vulnerability. An insecure sudoers configuration in /etc/sudoers.d/telenia grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to execute arbitrary commands as root.

GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys, achieving remote code execution when git performs ssh operations.

OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots with the ucode docker_rpc.uc backend) contains an OS command injection vulnerability. The docker.container.ttyd_start method is exposed via ubus, and the run_ttyd handler builds a shell command from request-controlled fields (id, cmd, uid) and passes it to system() without quoting. An authenticated attacker with only read ACL can inject shell metacharacters and execute arbitrary commands as root.

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script. Unauthenticated attackers can supply directory traversal sequences in the query string to read files outside the configured runtimeDir.

Admidio before 5.0.11 contains an authentication bypass vulnerability in the forum module when configured in login-only mode. The access control logic in modules/forum.php fails to validate the configuration state, allowing unauthenticated attackers to read forum topics and posts.

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(). The function passes its unsanitized $image argument to UniformResourceLocator::findResource(), which only lexically collapses '..' segments without a realpath check. An editor with page-editing rights can use Markdown image syntax with traversal sequences to composite arbitrary image files outside the media sandbox into a carrier image, which is then served publicly.

Grav CMS versions 2.0.7 through 2.0.10 fail to validate fully-qualified static method calls (Class::method) in blueprint dynamic-field directives. Blueprint::isSafeDynamicCall() only applies its denylist to strings without '::'. An account with page-editing rights (admin.pages) can plant a directive that invokes an arbitrary public static PHP method with attacker-controlled arguments. This allows reading any server-readable file and arbitrary creation/copying of files and directories.

SiYuan versions before v3.7.3 fail to validate the avID parameter in attribute-view read endpoints, allowing attackers to construct traversal paths that escape the storage directory. Authenticated users with RoleReader permissions or anonymous clients when publish authentication is disabled can read JSON files outside the attribute-view directory to disclose cross-scope database content.

SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingInsertTransaction endpoints that return rendered block DOM without publish-access checks. Anonymous readers or publish RoleReader tokens can supply a heading block ID to read full rendered content of publish-disabled documents that should be restricted.

SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints. While the corresponding backlink list endpoints filter publish-forbidden documents, the content endpoints (gated only by CheckAuth) do not. A publish-mode reader — including an anonymous reader when publish Basic Auth is disabled — can call these endpoints directly with a publish-forbidden document's ID to retrieve its rendered DOM content and to determine whether the document references a given block (a reference-existence oracle).

SiYuan versions before v3.7.3 contain an authentication bypass vulnerability in publish mode where content-returning endpoints getHeadingChildrenDOM, getHeading*Transaction, and getBacklinkDoc perform no password check despite protecting the primary getDoc endpoint. Anonymous attackers can retrieve full content of password-protected documents by obtaining internal block IDs from reader-accessible endpoints and calling unprotected content endpoints to bypass the password gate.

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.

Deserialization of untrusted data vulnerability in TUBITAK BILGEM Software Technologies Research Institute eta-otp-lock allows Object Injection. This issue affects eta-otp-lock: before 1.0.4.

A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switch_info/network.switch_status of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

A vulnerability in the Net::SAML2 library for Perl (versions before 0.86) allows SAML authentication bypass via XML signature wrapping. The new_from_xml function reads assertion identity using document-wide XPath instead of the signed subtree, allowing an attacker to prepend an unsigned assertion and assume a user's identity.

A vulnerability in the Net::SAML2 library for Perl (versions before 0.86) allows SAML authentication bypass by verifying responses against the response-embedded certificate when no trust anchor is configured. The verify_xml function accepts a response signed with an attacker's key, allowing authentication of an arbitrary assertion.