CVE Vulnerability Catalog

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a shell command with an incomplete denylist.

Use After Free vulnerability in Arm Ltd Valhall and Arm 5th Gen GPU Kernel Drivers allows a local non-privileged user process to access already freed memory by performing valid GPU processing operations.

AMI APTIOV contains a vulnerability in BIOS where a privileged user may cause the 'Incomplete List of Disallowed Inputs' by local access. Successful exploitation may lead to arbitrary code execution and impact system Confidentiality, Integrity, and Availability.

Missing authorization in Ivanti Endpoint Manager Mobile before versions 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

A Deserialization of Untrusted Data vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

Exposure of sensitive information vulnerability in Arm Ltd GPU kernel drivers (Valhall, Arm 5th Gen) allows a local non-privileged process to gain access to sensitive kernel information via improper GPU memory processing operations.

An issue in the btm_acl_handle() function of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet.

A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet.

An issue in the l2cap_handle_data() function of Bestechnic BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to cause a Denial of Service (DoS) via sending a crafted L2CAP packet.

XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated non-super administrators with style permissions to write arbitrary files outside the intended extraction directory by using backslash-based traversal sequences in ZIP member names.

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check.

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation.

XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value.

XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired.

XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by submitting a previously used authorization code.

XenForo before version 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint. An unauthenticated attacker can obtain valid token pairs by submitting empty values for client_secret and code_verifier parameters, exploiting PHP truthy evaluation logic that treats empty strings as false and skips client secret and PKCE validation.

An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality. Encrypted connections to target devices were established without validating the remote host's identity, and no option was provided to enable it. A man-in-the-middle attacker can impersonate the device during a polling session and intercept communication, including credentials.

An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of entries. Actual credential values are not directly visible, but the user can delete entries or edit their properties.

A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.