CVE Vulnerability Catalog

Use-after-free vulnerability in the Printing component of Google Chrome prior to version 149.0.7827.103. A remote attacker could potentially escape the sandbox via a crafted HTML page.

Use-after-free vulnerability in the Gamepad component of Google Chrome on Windows prior to version 149.0.7827.103. A remote attacker could potentially escape the sandbox via a crafted HTML page.

YesWiki before version 4.6.6 contains an unsafe execution vulnerability in the Bazar form field calculator (CalcField.php), where the application attempts to sanitize mathematical formulas using a complex regular expression before passing them to eval(), which is vulnerable to ReDoS and can lead to arbitrary PHP code execution.

Improper neutralization of triple-quote characters in AgentCore CLI before v0.14.2 during Python code generation. An authenticated remote attacker can execute arbitrary code on AWS AgentCore Runtime and on the local environment of another user in the same AWS account.

In the Linux kernel, a bug in the extract_kvec_to_sg function within the scatterlist library causes incorrect length calculations when extracting data from a kvec to a scatterlist. This can result in an sglist entry exceeding the page size, which is unintended. The vulnerability was introduced in kernel v6.3 and affects v6.5+.

AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin access by supplying a path traversal sequence in the Admin-Token cookie, exploiting unsanitized string concatenation in the token file path construction within the authglinet middleware.

OpenBullet2 through version 0.3.2 has an authentication bypass vulnerability in the API key authentication middleware. Unauthenticated attackers can gain admin access by supplying an empty X-Api-Key header value, as it is compared against a default empty AdminApiKey string.

A vulnerability in Flowise prior to version 3.1.2 allows an authenticated attacker to achieve remote code execution by submitting arbitrary JavaScript to the Custom JS Function node. Missing authorization on the POST /api/v1/node-custom-function endpoint.

Flowise prior to version 3.1.2 has a mass assignment vulnerability in the assistant update endpoint. An authenticated user can modify server-controlled properties such as workspaceId, createdDate, and updatedDate. Due to missing server-side validation and authorization checks, an attacker can manipulate the workspaceId field and reassign assistants to arbitrary workspaces.

In Flowise prior to version 3.1.2, the checkBasicAuth endpoint validates credentials in plaintext without rate limiting and with direct comparison. This allows an attacker to perform a brute-force attack on passwords.

Buffer Underwrite vulnerability in Apache HTTP Server when processing crafted regular expressions in configuration. Affects versions 2.4.0 through 2.4.67.

In Flowise prior to version 3.1.2, a mass assignment vulnerability exists in the variable update endpoint. An authenticated attacker can modify server-controlled properties such as workspaceId, potentially breaking tenant isolation in multi-workspace environments.

A path handling issue in mod_dav_fs in Apache 2.4.67 and earlier allows a WebDAV content author to directly manipulate trusted DAV property databases, potentially causing child process crashes.

Apache HTTP Server versions 2.4.0 through 2.4.67 have a Use After Free vulnerability in mod_ldap with per-directory configuration. This can lead to undefined behavior.

A vulnerability in Tenda HG7, HG9 and HG10 devices affects the formDOMAINBLK function in the /boaform/formDOMAINBLK file. Manipulating the blkDomain argument leads to a stack-based buffer overflow, which can be exploited remotely.

WordPress Theme Travelscape 1.0.3 contains an arbitrary file upload vulnerability. Unauthenticated attackers can upload malicious files by exploiting insufficient validation in the theme's upload functionality.

The WordPress Background Image Cropper plugin version 1.2 contains a remote code execution vulnerability, allowing unauthenticated attackers to upload arbitrary files via the ups.php endpoint. Attackers can upload PHP files and execute code on the server.

WordPress Seotheme has a remote code execution vulnerability. Unauthenticated attackers can execute arbitrary PHP code by uploading malicious files to the theme directory. Attackers can access the uploaded PHP shell at /wp-content/themes/seotheme/mar.php.

Two endpoints in the Vault Service ScriptsController, shared by Altium Enterprise Server and Altium 365, accept file uploads where a user-supplied filename is used to construct the destination path without validation, allowing arbitrary file writes. The write occurs before authentication, so no credentials are needed.