CVE Vulnerability Catalog

A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected Safari crash.

The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2, tvOS 26.2, visionOS 26.2, watchOS 26.2. A malicious HID device may cause an unexpected process crash.

A race condition was addressed with improved state handling. Processing maliciously crafted web content may lead to an unexpected process crash.

Problem dotyczy niewłaściwej walidacji adresów URL w Safari, co może pozwolić na wykorzystanie interfejsów API Web w kontekście, który powinien być ograniczony. Został naprawiony w wersji Safari 26.2 oraz macOS Tahoe 26.2.

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Processing maliciously crafted web content may lead to an unexpected process crash.

Problem z konfiguracją został rozwiązany poprzez wprowadzenie dodatkowych ograniczeń. Problem ten został naprawiony w iOS 26.2, iPadOS 26.2, macOS Tahoe 26.2 oraz visionOS 26.2, gdzie zdjęcia w albumie Ukryte mogą być przeglądane bez uwierzytelnienia.

Missing cryptographic key commitment in Amazon S3 Encryption Client for Go. A user with write access to the S3 bucket can introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an instruction file instead of S3 metadata.

Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata record. To mitigate this issue, upgrade AWS SDK for Ruby to version 1.208.0 or later.

In DriveLock Operations Center versions 25.1.2 before 25.1.5, a Cross Site Scripting (XSS) issue allows for session takeover over a network.

In DriveLock versions 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5, local unprivileged users can manipulate privileged processes to gain more privileges on Windows computers.

A buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin/httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code execution by sending a POST request with a crafted payload (field `serverName`) to /goform/AdvSetMacMtuWan.

In Tenda AC10V4.0 router version V16.03.10.20, a buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd allows remote attackers to cause denial of service and possibly code execution by sending a post request with a crafted payload (field `serviceName`) to /goform/AdvSetMacMtuWan.

A vulnerability was discovered in the IPv6 fragmentation reassembly implementation of RIOT OS v2025.07. When receiving a fragmented IPv6 packet with fragment offset 0 and an empty payload, the payload pointer is set to NULL, but the implementation still tries to copy the payload into the reassembly buffer, resulting in a NULL pointer dereference which crashes the OS (DoS). To trigger the vulnerability, the gnrc_ipv6_ext_frag module must be enabled and the attacker must be able to send arbitrary IPv6 packets to the victim.

Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF'] in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path.

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video.

AVideo versions prior to 20.1 permit any authenticated user to upload comment images to videos owned by other users. The endpoint validates authentication but omits ownership checks, allowing attackers to perform unauthorized uploads to arbitrary video objects.

AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.

Incorrect access control in the /templates/ component of RiteCMS v3.1.0 allows attackers to access sensitive files via directory traversal. The vulnerability enables reading files outside the intended directory.