CVE Vulnerability Catalog

Microsoft UFO prior to 3.0.10 contains a vulnerability in the type_text and launch_app tools where text and package_name parameters are passed to adb shell commands without proper validation. An attacker with a valid Mobile MCP API key can execute additional commands on an authorized device as the Android shell user.

A Cross-site Scripting (XSS) vulnerability exists in the Forums feature of OpenText Content Management Content Server. A bad actor could inject malicious code into a Forums web page.

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where nocache_hash is not restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply data with a forged SmartyNocache marker that is copied into the PHP cache file, enabling arbitrary PHP execution.

Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158.

Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 contains a SQL injection vulnerability in the mysql_query function in admin/login.php (Administrator Login Endpoint). Manipulation of username/password arguments allows remote attack.

QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminProductsController::ajaxProcessBulkUpdateRooms. Hotel-restricted back-office employees can modify rooms of other hotels by submitting foreign room IDs in the id_rooms parameter, changing status, floor, comments, or inactive dates.

PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing brute force of two-factor codes. Attackers who know a user's password can reuse the ten-minute pending token to guess codes and obtain a full access token.

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the apiSourceGetContent endpoint to obtain database passwords, LDAP bind credentials, and other projects' data.

HCL BigFix Service Management is affected by an Improper Input Validation vulnerability, which could allow an attacker to supply unexpected or malformed data, enabling processing errors, business logic bypasses, and unintended application behavior.

Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2 contains a SQL injection vulnerability in the mysql_error function in login.php (Login Endpoint). Manipulation of username/password arguments allows remote attack.

GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wordlist, the word length is stored as a single byte, causing truncation for words whose length is a multiple of 256, leading to heap corruption. An attacker can exploit this by convincing a user to run aspell with a crafted personal wordlist containing such a word, resulting in denial of service. This issue was fixed in commit 782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d, which will be released in version 0.60.8.3.

GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a user to run aspell with a crafted dictionary file supplied through --master, --dict-dir, or configuration options, leading to heap memory disclosure or a denial of service via application crash.

GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to process a malicious compressed file with prezip-bin can trigger memory corruption, leading to a process crash.

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. An authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides, leading to arbitrary Twig evaluation and then system command execution.

A vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin involves insecure deserialization due to the use of PHP's native unserialize() function without restrictions on allowed classes. An attacker who can write to the cache backend (e.g., Redis, Memcached) can inject crafted PHP objects and execute arbitrary code.

In the WibuKey driver for Windows below version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent kernel memory may be modified.

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. Affected versions include 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 (and later).

A vulnerability in the Linux kernel's xfrm IP-TFS module allows an out-of-bounds stack read in iptfs_skb_reset_frag_walk() due to missing fragment index validation. A crafted AGGFRAG packet can trigger this, causing a system crash or potential information leak.

In the Linux kernel, a flaw in xfrm/iptfs handling of inner packet fragmentation occurs when the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one. This bypasses IP header length validation, leading to a buffer overflow and kernel panic (DoS).

In the Linux kernel, a use-after-free vulnerability was fixed in xfrm_state_netlink() when handling ALLOCSPI requests. xfrm_alloc_userspi() calls alloc_compat() again, but passes the original request skb and its header, which for compat requests causes the 228-byte compat xfrm_userspi_info to be interpreted as the 232-byte native layout and reads four bytes past the declared payload. A multicast clone of the request shares skb_shared_info and can observe that child, and xfrm_user_rcv_msg() frees it after the request handler returns, leading to a race and use-after-free.