CVE Vulnerability Catalog

Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint.

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.

A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.

Vvveb prior to version 1.0.8.6 contains an SSRF vulnerability because host validation only handles IPv4, not IPv6. An authenticated admin-panel user can exploit the oEmbed proxy to read internal services and cloud metadata, including IAM credentials.

Vvveb prior to version 1.0.8.6 has a flawed path sanitizer that allows an authenticated user with backup access to read and delete arbitrary files on the server. This can expose database credentials, read system files, and delete config/db.php to enable full site takeover.

Vvveb prior to version 1.0.8.6 has an HTML sanitizer that fails to strip event-handler attributes when a tag contains a greater-than character inside a quoted attribute value. A low-privilege content author can store malicious JavaScript that executes in browsers of visitors and administrators, potentially leading to admin account takeover.

The Confluent Kafka Python client's HashiCorp Vault KMS integration has improper TLS certificate validation, which could allow a remote attacker to obtain sensitive information.

Lektor 3.3.14 and 3.4.0b15 contains a CSRF vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions such as writing files, deleting pages, wiping build output, and triggering publication, by sending requests from malicious web pages.

Podgrab contains an unauthenticated denial-of-service vulnerability caused by unsynchronized concurrent access to shared maps in its WebSocket handler. A remote attacker can open multiple WebSocket connections and send messages in a loop, causing a Go runtime data race that crashes the process, requiring operator intervention.

Tapo C120 v1 and C200 v5 cameras have a NULL pointer dereference vulnerability in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate the presence of a password field for certain parameter combinations, allowing a malformed request from the local network to crash the HTTPS service.

AWS security-agent-mcp-server before version 0.2.0 has an argument injection vulnerability in the diff scan operation, which could allow an attacker to create, overwrite, or truncate arbitrary files on the host outside the intended workspace directory via a crafted reference value.

Tapo C120 v1 and C200 v5 cameras do not enforce authentication for HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network.

djehuty prior to version 26.3.2 contains a SPARQL injection vulnerability in search/listing queries through three parameters. An unauthenticated attacker can execute read queries, allowing cross-graph data exfiltration (e.g., private data) and denial-of-service via expensive or malformed queries.

The Smile parser in FasterXML jackson-dataformats-binary never invokes StreamReadConstraints.validateNameLength() when decoding JSON object property names, so the maxNameLength limit is not enforced for this format. An attacker who can have a Smile document parsed may embed a property name of unbounded length, causing memory exhaustion and denial of service. This issue also affects the CBOR parser and is tracked in advisory GHSA-3v8f-v6vx-fmrm.

The CBOR parser in FasterXML jackson-dataformats-binary does not enforce the maxNameLength limit for JSON object property names, allowing processing of names of unbounded length. An attacker can submit a CBOR document with an extremely long property name, leading to memory exhaustion and denial of service. The vulnerability is specific to binary formats and does not affect the standard JSON parser in jackson-core.

An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-user command privileges. Under certain shell operations, a command may be evaluated without the normally applied privilege check, allowing an authenticated user with limited privileges to execute commands they are not authorized to run. The issue affects all versions of VxWorks 7 prior to 26.09 and has been fixed in 26.09.

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service that becomes accessible after a reboot, and submit crafted input to execute arbitrary commands within the device management process.

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands.