CVE Vulnerability Catalog

Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.

A security flaw in TinyFileManager up to version 2.6 allows unrestricted file upload via the move_uploaded_file function in tinyfilemanager.php by manipulating the fullpath argument. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability in RuoYi 4.8.3 involves an unknown function that allows cross-site request forgery (CSRF). The attack can be executed remotely.

A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::sendFindPwdMail of the file Admin/Home/Controller/PublicController.class.php of the component Password Recovery Mail Endpoint. This manipulation of the argument email causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206 involving the use of a hard-coded cryptographic key. The attack may be launched remotely. The issue is fixed in version 9.5.6 Build 3623.

A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting unknown code of the file /personnel/api/employees/ in the Employee REST API component. The manipulation leads to authorization bypass and the attack may be initiated remotely.

A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting an unknown part of the file /iclock/finger_data/ in the Biometric Data Endpoint component. Manipulating the emp_code argument can lead to authorization bypass and the attack can be launched remotely.

A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting some unknown functionality of the file /base/api/systemSettings in the System Settings API component. The manipulation results in improper access controls and the attack can be initiated remotely.

ZDR decoding in libnfs through 6.0.2 before commit 7613236 has an out-of-bounds write in lib/libnfs-zdr.c involving libnfs_zdr_bytes(), libnfs_zdr_string(), and libnfs_zdr_array(). The caller-supplied maxsize value is not honored.

VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device.

ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the same user account. The attacker must be able to create a symlink inside the cache path. Version 3.0.4 fixes this for the case of a symlink created at an arbitrary earlier time, but does not resolve an applicable TOCTOU race condition.

A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ in the Database Migration Functionality component. Such manipulation leads to SQL injection and the attack can be launched remotely.

A weakness in CicadasCMS up to version 2431154dac8d0735e04f1fd2a3c3556668fc8dab affects the TemplateController.input function in the file /system/cms/template/input of the Template Management component. Manipulation of the filePath argument causes path traversal. The attack can be initiated remotely, and the exploit is publicly available.

A path traversal vulnerability has been discovered in westboy CicadasCMS up to commit 2431154dac8d0735e04f1fd2a3c3556668fc8dab, affecting the TemplateController.save function in /system/cms/template/save (Backend Template Editor component). The attack can be performed remotely and a public exploit is already available. The vendor was contacted but did not respond.

A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2, affecting the agent function of the dsh-workflow-worker-thread component. The manipulation leads to enforcement of behavioral workflow. The attack can be carried out remotely and the exploit is publicly available. The vendor did not respond.

GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime.

In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges.

In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation of scheduling information in SIB1 messages. This could lead to remote code execution or denial of service with no additional execution privileges needed.

In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.