CVE Vulnerability Catalog

NVIDIA TensorRT-LLM for Linux contains a vulnerability that could allow an attacker to bypass authentication for a critical function. Successful exploitation may lead to code execution, data tampering, and information disclosure.

A vulnerability in NVIDIA TensorRT-LLM for Linux exists in the multimodal media fetching functions, allowing a network-accessible attacker to perform server-side request forgery (SSRF). Successful exploitation could lead to denial of service and information disclosure.

NVIDIA TensorRT contains a vulnerability involving deserialization of untrusted data. Successful exploitation of this vulnerability could lead to code execution.

A vulnerability in NVIDIA TensorRT-LLM for Linux allows an attacker to cause improper control of code generation. Successful exploitation could lead to code execution, data tampering, and information disclosure.

NVIDIA TensorRT-LLM contains a vulnerability in the visual gen server that allows unsafe deserialization via unauthorized zeroMQ deserialization. Successful exploitation could lead to code execution.

Insufficient validation of untrusted input in Navigation in Google Chrome prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.

An inappropriate implementation in the V8 JavaScript engine in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is rated as High severity by the Chromium security team.

Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.

An uninitialized use vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.125 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Insufficient policy enforcement in HTML-in-Canvas in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

An uninitialized use vulnerability in the Skia library in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

A path traversal vulnerability was discovered in mastergo-design mastergo-magic-mcp up to version 0.2.0 in the execute function of src/tools/get-c2d.ts (component mcp__C2d). The attack requires local access and manipulation of the filePath argument. The exploit is public, and the project has not responded to the issue report.

Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network.

A vulnerability in Symfony allows an attacker to manipulate URL paths via controlled route parameters. The UrlGenerator::doGenerate() function uses strtr() dot-segment encoding that skips every other chained ../ or ./ segment, enabling generation of URLs that collapse to a different path under RFC 3986 normalization.

In Symfony PHP framework from 6.1.0 to 6.4.41, 7.4.13, and 8.0.13, UrlAttributeSanitizer::getSupportedAttributes() omitted URL-bearing attributes on <object>, <applet>, <iframe>, and <img>, and <meta http-equiv="refresh"> URLs bypassed sanitization, allowing javascript: payloads. Fixed in versions 6.4.41, 7.4.13, and 8.0.13.

A vulnerability in Symfony allows bypassing URL sanitization via percent-encoded BiDi formatting characters, enabling visual-spoofing character injection. Affects versions from 6.1.0 to 6.4.41, 7.4.13, and 8.0.13.

A vulnerability in Symfony allows an attacker to downgrade the Mailomat webhook signature algorithm from SHA-256 to a weaker one by manipulating the X-MOM-Webhook-Signature header. The issue affects MailomatRequestParser::validateSignature() before versions 7.4.13 and 8.0.13.

Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that allows a low-privileged attacker to inject malicious scripts into vulnerable form fields. The script executes in the victim's browser when viewing the page with the field. The scope is changed.

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.