CVE Vulnerability Catalog

A vulnerability in Better Auth versions 1.6.0 through 1.6.11 allows an authenticated attacker who knows a valid user_code to hijack a pending device authorization session. The issue stems from missing ownership checks in GET /device, POST /device/approve, and POST /device/deny endpoints.

Cherry Studio versions 1.2.2 through 1.9.12, fixed in commit 1518530, contain a remote code execution vulnerability in SearchService. Attackers can deliver malicious JavaScript through controlled search provider content into an Electron BrowserWindow with nodeIntegration enabled and contextIsolation disabled.

In Splunk Enterprise and Splunk Cloud Platform, a path traversal vulnerability exists in the app installation workflow. A user with `edit_local_apps` and `install_apps` capabilities can write files outside the intended app directory into `$SPLUNK_HOME/etc/` and its subdirectories.

In Splunk Enterprise and Splunk Cloud Platform, a CSRF vulnerability allows an attacker to trick a user with appropriate privileges into executing arbitrary SPL searches as the splunk-system-user. The issue is due to missing CSRF token validation on GET requests in Deployment Server endpoints and improper input neutralization before inclusion in an SPL search.

A flaw in the AAP Gateway Envoy proxy configuration fails to remove the Subject HTTP header from client requests in non-mTLS routes to EDA event streams, despite the source code defining its removal. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams.

The Zephyr ADIN2111/ADIN1110 Ethernet driver in OA SPI mode lacks a bounds check when reassembling frames, allowing an attacker on the same Ethernet segment to cause an out-of-bounds write and potentially execute code.

Apollo ConfigService before version 2.5.2 may allow unauthorized access to raw configuration data when AccessKey or management key authentication is enabled. The issue stems from incorrect parsing of the request path /configfiles/raw/{appId}/{clusterName}/{namespace}, where the application ID is read as 'raw' instead of the actual value from the URL, potentially bypassing signature verification for the target application.

Apollo ConfigService prior to version 2.5.2 may allow unauthorized access to configuration data when AccessKey or management key authentication is enabled. This occurs because ConfigService accepts non-canonical appId variants (e.g., accent or trailing-space variants) during authentication, which are later resolved to the protected app on /configs and /configfiles endpoints.

A vulnerability in Postiz, an AI social media scheduling tool, allows a low-privileged account to grant arbitrary organizations lifetime PRO subscriptions without payment. The issue stems from missing verification of Nowpayments IPN callback authenticity and reading the subscription identifier from an untrusted request body.

A vulnerability in the Diffusers library before version 0.38.0 allows bypassing the trust_remote_code guard. The download() method validates model_index.json and custom pipeline code but later loads from a cached folder that can change, enabling execution of malicious .py code from a Hub repository without requiring trust_remote_code=True.

A vulnerability in Composer, a dependency manager for PHP, allows disclosure of GitHub OAuth tokens in error logs. Token validation using a regex rejects GITHUB_TOKEN values containing '-', and the rejected token is interpolated into an exception message, leading to leakage to stderr or CI logs.

CVE-2026-20187 involves improper handling of exceptional conditions in Cisco RoomOS software. It was discovered during an internal security review and addressed in a hardening release.

As part of an internal security review of Cisco RoomOS, multiple vulnerabilities related to improper control of a resource through its lifetime were identified. These flaws are classified under CWE-664 and have been addressed in a software hardening release.

The vulnerability in Cisco RoomOS is due to missing encryption, which could lead to exposure of sensitive data. The issue was discovered during an internal security review and addressed in a software hardening release.

As part of an internal security review of Cisco RoomOS, a vulnerability related to improper restriction of operations within a memory buffer (CWE-119) was identified. This flaw could allow an attacker to perform unauthorized memory operations.

As part of an internal security review of Cisco RoomOS, multiple vulnerabilities related to improper input validation (CWE-20) were identified. These flaws could allow an attacker to manipulate input data, potentially leading to unauthorized actions.

As part of an internal security review of Cisco RoomOS, multiple vulnerabilities related to improper access control (CWE-284) were identified. These vulnerabilities have been addressed in a software hardening release.

In File Browser before version 2.63.17, when Signup and CreateUserDir are enabled, the cleanUsername() function normalizes usernames in a way that can cause collisions (e.g., 'team/one', 'team one', and 'team-one' map to the same home directory). This allows a second registrant to gain full access to another user's files.

A vulnerability in Nixpkgs affects the MySQL services.mysql module, which initializes the MySQL database in a way that allows local users (e.g., unprivileged CGI processes) to log in as root without a password. The issue occurs with mysql or percona-server and is fixed in channels 25.11 and 26.05.

A vulnerability in Microsoft AVML before version 0.17.0 allows following a symlink when opening a destination output path on Unix, enabling truncation or overwrite of the symlink target. The destructive effect occurs at open time via O_TRUNC, before full input validation completes (truncation-before-validation).