CVE Vulnerability Catalog

A vulnerability was detected in PHPGurukul Blood Donor Management System 1.0. It affects an unknown functionality in the file /application/controllers/admin/Report.php of the Report Endpoint component. Manipulation of fromdate/todate arguments results in SQL injection. The attack can be launched remotely, and the exploit is public.

A vulnerability was detected in PHPGurukul Blood Donor Management System 1.0. It affects the __construct function in /application/controllers/admin/Dashboard.php of the Admin Controllers component. The manipulation leads to improper authentication. The attack can be initiated remotely, and the exploit is public.

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in the full Spring context when a mail task uses variable-backed body fields, enabling method invocation on application beans.

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (cs_...) to retrieve the full session object, including the buyer's name, email, phone, billing address, amount paid and internal userId, because the GET handler calls stripe.checkout.sessions.retrieve() and returns the result without checking for an authenticated session or session ownership. The session_id is exposed in the buyer's own browser URL after payment (success_url = /result?session_id={CHECKOUT_SESSION_ID}), so it leaks through Referer headers, analytics tools, server access logs and shared-machine browser history, resulting in disclosure of the buyer's personal data to an unauthenticated actor.

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track users across apps and websites without permission.

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure.

An information disclosure issue was addressed with improved state management. The issue affects iOS 27, iPadOS 27, tvOS 27, visionOS 27, and watchOS 27. A local app may be able to read a persistent account identifier.

A logic issue was addressed with improved checks. The issue affects macOS Golden Gate 27. An app may be able to break out of its sandbox.

The issue was addressed with improved memory handling. The vulnerability affects iOS, iPadOS, macOS, tvOS, visionOS, and watchOS. Processing a maliciously crafted 3D model may lead to memory corruption.

This issue was addressed with additional entitlement checks. Fixed in macOS Golden Gate 27. An app may be able to gain root privileges.

This issue was addressed with additional entitlement checks. The vulnerability affects iOS, iPadOS, tvOS, visionOS, and watchOS. An app may be able to fingerprint the user.

An authorization issue was addressed with improved state management. This affects iOS and iPadOS. An app may be able to fingerprint the device.

An integer overflow was addressed with improved input validation. This affects multiple Apple systems. Processing a maliciously crafted 3D model may lead to memory corruption.

An out-of-bounds write issue in Apple systems was addressed with improved bounds checking. Processing a maliciously crafted 3D model may lead to memory corruption. The fix covers iOS 26.7/27, iPadOS 26.7/27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, and watchOS 27.