CVE Vulnerability Catalog

A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component; an attacker who obtains an affected backup file may extract the cryptographic material from the firmware and decrypt the backup.

An SSRF vulnerability allows access to internal Chrome DevTools Protocol APIs, which can leak the JWT authentication token of another user. A low-privileged attacker could repeatedly exploit this when starting a recording to obtain the victim's JWT token, gaining read/write access to the victim's Whiteboard.

A user in a group can bypass the link-sharing restriction set by an administrator and create share links for a table despite lacking that permission.

When a team was configured as "visible to everyone", the web UI correctly blocked non-members, but the resources API endpoint could still be called directly. This allowed any authenticated non-member to enumerate the team's internal resources and their identifiers.

A user could create a docx or odt file with a # in the filename containing confidential information such as a credit card number, and the file would not be marked as confidential.

App passwords were allowed to bypass password confirmation on sensitive endpoints. This enabled sensitive operations to be performed without re-authentication.

An out-of-bounds write in the chan_unistim module's DIALPAGE digit handling can overflow the phone_number field and crash Asterisk when a crafted incoming request packet is sent. The chan_unistim module must be loaded and configured with a reachable UNISTIM UDP port, and the attacker must register as a configured phone MAC or use an equivalent autoprovisioning path. The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

An authenticated attacker may crash Asterisk through a buffer over-read in the PJSIP MWI body parser by sending a crafted SIP NOTIFY request. The attacker must pass SIP authentication using a username/password or source IP address matching. The issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

In knative.dev/pkg/webhook, the admissionHandler decodes an attacker-supplied AdmissionReview without a request body size limit (no http.MaxBytesReader). A pod-network client can send one oversized POST to an admission webhook, causing amplified copies of the request to be retained until the controller pod exhausts memory and is OOM-killed. This affects all consumers of the shared webhook server, including Knative, Tekton, KEDA, Sigstore policy-controller, and Kpack; fixed in version 0.0.0-20260531000007-52dbd5ece63f.

Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. Exploitation requires user interaction, as the victim must open a malicious file.

In the systeminformation library, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the _network object indexed by the sanitized caller-controlled interface name. Passing proto causes the inherited Object.prototype value to be used instead of creating an own entry, so calcNetworkSpeed() writes rx_bytes, tx_bytes, rx_sec, tx_sec, ms, last_ms, and operstate onto Object.prototype. The polluted property names are fixed and values come from interface statistics, but name collisions and enumerable keys can corrupt application branching, serialization, configuration merging, validation, or lookup behavior; fixed in version 5.33.13.

A malicious X server could send malformed RECORD EnableContext replies that cause an X client using the parse_reply_call_callback function in libXtst before 1.2.6 to enter an endless loop.

An authenticated user with the Restore Operator role who also controls the contents of a backed-up NAS share can write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.

An authenticated user with the Restore Operator role who also controls the contents of a backed-up NAS share can write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.

An unauthenticated attacker can bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.

A low-privileged local user can write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.

An improper authentication vulnerability in WatchGuard Fireware OS's AuthPoint multi-factor authentication process allows a local, unauthenticated attacker on the appliance to hijack another user's in-progress MFA session by supplying a specially crafted request and convincing the victim user to accept an MFA push notification.

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr00tsonic Checkpoint Loader. Manipulation of the weight_map argument causes path traversal. The exploit has been published and may be used; the project has not responded to the issue report.

A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The manipulation results in path traversal. The attack may be launched remotely, and the exploit is now public and may be used; the project has not responded to the issue report.

Cleartext Transmission of Sensitive Information vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker who can capture loopback traffic to obtain the user's VPN username and password.