CVE Vulnerability Catalog

An out-of-bounds read in libXi's XQueryDeviceState() before version 1.8.4 could be exploited by an attacker. The description is incomplete, but the vulnerability may lead to information disclosure or a crash.

Araxis Merge for Windows versions 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry without sufficient cryptographic protection. An authenticated, non-administrative attacker could retrieve and unencrypt all credentials stored by the target user.

In the ZBar library, the decode6() function for Code 128 barcodes contains an undefined-behavior vulnerability. When decode_e() returns -1 for an invalid edge pattern, decode6() left-shifts this negative signed value, which is undefined behavior. This can cause a crash (SIGILL) in UBSan builds, leading to denial of service.

libconfini 1.16.4 contains a heap out-of-bounds write condition involving the bundled load_ini_buffer.h utility and strip_ini_cache(). The bundled utility allocates exactly ini_length bytes, while strip_ini_cache() unconditionally writes a NUL terminator at ini_source[ini_length], requiring an additional writable byte.

simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access buf[len] after the input buffer has been exhausted.

Termix versions 1.7.0 through 2.5.1 derive a grep pattern from user-controlled public-key input and interpolate it into shell commands executed on the target host during SSH key deployment. An authenticated user can inject shell syntax and execute commands with the privileges of the selected remote account. The issue is fixed in version 2.5.1.

Termix versions 2.5.0 through 2.5.1 allow authenticated users to configure webhook or ntfy notification channels with attacker-controlled destination URLs and trigger server-side requests via the notification-channel test endpoint. The lack of destination allowlisting or private-address blocking permits blind requests to internal HTTP services. The issue is fixed in version 2.5.1.

Termix versions 1.7.0 through 2.5.1, in the POST /credentials/:id/deploy-to-host endpoint, resolves credential and target-host records from attacker-controlled credentialId and targetHostId values without verifying ownership. Differential errors reveal record existence and authType values, and a key-authenticated victim host can receive an outbound SSH connection attempt using the attacker's public key. The issue is fixed in version 2.5.1.

Termix versions 1.8.0 through 2.5.1 allow authenticated users to access the server-stats API without per-host authorization. GET /status, GET /status/:id, and POST /clear-connections expose host state and let a regular user clear the global SSH connection pool. The issue is fixed in version 2.5.1.

LaSuite Doc versions 4.8.2 through 5.4.0, in GET /api/v1.0/documents/search/, accepts sequential seven-digit document paths without requiring the caller to know the public UUID. An unauthenticated attacker can enumerate public document subtrees, obtaining identifiers, titles, creator data, and metadata, while differing 403/404 responses reveal path existence. The issue is fixed in version 5.4.0.

HCL Sametime is vulnerable to insufficient input sanitization. The application did not properly sanitize user input, which is implicitly or explicitly trusted without sufficient validation. Malicious actors can leverage this vulnerability.

A vulnerability was detected in Excalidraw up to 0.18.1 in an unknown function of packages/excalidraw/data/restore.ts within the Imported File Handler component. Manipulating the customData.generationData.html argument leads to cross-site scripting, and the attack can be carried out remotely. The exploit is public and the vendor did not respond to the disclosure.

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (GET /v1/admin/logs/file). The path confinement check uses str.startswith() rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json files outside the configured LOG_FOLDER.

HAVELSAN Inc. Liman Render Engine contains an improper certificate validation vulnerability that allows an Adversary in the Middle (AiTM) attack. This issue affects versions from 1.0 before 1.2-75.

Liman Render Engine contains a key exchange without entity authentication vulnerability, allowing an Adversary in the Middle (AiTM) attack. This issue affects versions from 1.0 before 1.2-75.

IBM Concert versions 1.0.0 through 3.0.0 allow recursive copying of directories without proper controls, which can lead to unintentional inclusion of sensitive or unnecessary files and increased attack surface.

A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails.

IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read.

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsController endpoints with blank or targeted search parameters to retrieve playlist names belonging to other users without authorization.