CVE Vulnerability Catalog

In Astro versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).

In the Synopsys DesignWare I2C driver (drivers/i2c/i2c_dw.c) operating in target/slave mode, the rx_full interrupt handler gates the write_requested() callback on dw->state != CMD_SEND, and dw->state is only reset to READY on a STOP interrupt. The START_DET interrupt, which would reset the state on every (re)START, was never added to the enabled interrupt mask, so that recovery path was dead code. As a result, if the STOP interrupt is lost or the bus master issues a legal WRITE-repeated-START-WRITE sequence, the driver remains in CMD_SEND permanently and never invokes write_requested() again.

In Papra prior to version 26.5.0, the webhook delivery system contains an SSRF protection bypass that allows any authenticated organisation member to cause the server to make HTTP requests to internal addresses (loopback, link-local, RFC-1918 ranges). The SSRF protection validates the registered webhook URL but ignores redirect destinations. The HTTP client (ofetch) follows 3xx responses automatically, and the redirect target is never checked against the blocklist.

A vulnerability in ggml-org whisper.cpp (commit 95ea8f9b) in the function ggml_ftype_to_ggml_type in file ggml/src/ggml.c. Manipulation of the ftype argument leads to a reachable assertion. Local access is required. The project has not responded yet.

An information disclosure vulnerability in HCL Connections via a specific endpoint. In certain scenarios, this could lead to sensitive information being disclosed to unauthorized users.

An information disclosure vulnerability in HCL Connections due to improper handling of request data. A user can obtain sensitive information they are not entitled to.

A vulnerability in ggml-org whisper.cpp 1.8.4-58 in the function log_mel_spectrogram in file src/whisper.cpp. Manipulation leads to an out-of-bounds read. Local access is required. A pull request with a fix is pending acceptance.

The ZTE File Manager application contains a vulnerability that allows third-party apps to launch the FilePreViewActivity and supply arbitrary file paths. This enables reading files with the file manager's privileges, including system directories like /data/data and /data/local/tmp on unrooted devices.

The WPBot WordPress plugin before version 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query. Users with administrator access can perform SQL injection that executes when a visitor triggers a search.

ImageMagick before 7.1.2-27 has a memory leak vulnerability in the magick CLI when invalid options are provided. Attackers can repeatedly supply malformed arguments to cause memory exhaustion.

A flaw was found in pki-core where the certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs. This allows an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.

A stack-based buffer overflow in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec devices (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.

The ProfileGrid WordPress plugin before version 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

In JetBrains GoLand before 2026.2 sensitive configuration values are written to log files by default.

Vulnerability in DNSSEC validation allows bypassing signature verification for wildcard expansion proofs (NSEC/NSEC3) when the answer is a CNAME or DNAME record.

A DNS issue occurs when the authoritative server responds very slowly and records expire in the meantime. In this case, TTL capping is not enforced due to lack of data. This does not happen during normal resolution.

In Unbound from version 1.6.0 up to 1.25.1, the 'view_local_data' and 'view_local_datas' commands in 'unbound-control' create a bare local zone tree for a view without default-protected zones (e.g., RFC 1918 reverse, AS112, .onion, .localhost). This causes queries for these names to be forwarded to public DNS instead of being answered locally, bypassing local policy.

In NLnet Labs Unbound from 1.18.0 up to 1.25.1, when listening on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node validates for every PROXYv2-declared source behind that node. An off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks.