CVE Vulnerability Catalog

Vanetza, an open-source implementation of the ETSI C-ITS protocol suite, in version 26.02 and earlier, has a denial-of-service vulnerability in the ASN.1/OER parsing pipeline. When processing malformed network packets with corrupted ASN.1/OER structures, the ASN.1 wrapper raises a std::runtime_error that is not caught, leading to std::terminate and process termination.

Flaw in gnutls certificate validation. An oversized Subject Alternative Name (SAN) can cause incorrect fallback to Common Name (CN) check, allowing a remote attacker to bypass certificate validation and perform spoofing or man-in-the-middle attacks.

A flaw in gnutls allows a remote attacker to present a specially crafted certificate with URI or SRV SANs, potentially causing incorrect hostname validation against CN and enabling service spoofing or data interception.

A race condition was addressed with additional validation in macOS Sequoia 15.7 and macOS Tahoe 26. An app may be able to gain root privileges.

A logic issue in macOS allows a malicious app to gain root privileges. The flaw is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26.

Vulnerability in JeecgBoot up to version 3.9.1 in the LoginController.selectDepart function in /sys/selectDepart, due to improper access controls. The attack can be performed remotely.

An attacker is able to downgrade the security of a Bluetooth LE connection by deleting an existing bond, spoofing the bonded device and creating a new bond.

In the epa4all-client Java client, a MITM attacker on the TLS connection between client and IDP can substitute a forged discovery document, redirecting the client to attacker-controlled URLs. The client then encrypts the SMC-B signed challenge response with the attacker's key and sends it to the attacker.

MaxKB before version 2.9.0 exposes the webhook endpoint (/api/trigger/v1/webhook/{trigger_id}) without authentication. The WebhookAuth class returns (None, {}), which is interpreted as successful authentication. An unauthenticated attacker who knows a valid trigger ID can invoke webhook triggers to execute bound tasks.

Vulnerability in LangChain before versions 0.3.85 and 1.3.3. Older runtime code paths deserialize inputs/outputs using overly broad object allowlists, allowing an attacker to supply malicious constructor dictionaries and instantiate objects with dangerous arguments.

Banks before version 2.4.2 uses unsandboxed jinja2.Environment() to render prompt templates, allowing Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) on the host.

Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Woocommerce Envato Affiliates: from n/a through 1.2.1.

Student Transcript Processing System 1.0 from itsourcecode has an SQL injection vulnerability in /admin/modules/class/index.php?view=view via the ID argument. The attack can be performed remotely, and the exploit is publicly available.

Student Transcript Processing System 1.0 from itsourcecode has an SQL injection vulnerability in /admin/modules/student/trans.php via the studentId or cid arguments. The attack can be performed remotely, and the exploit is publicly available.

Student Transcript Processing System 1.0 from itsourcecode has an SQL injection vulnerability in /admin/modules/student/index.php?view=view via the studentId argument. The attack can be performed remotely, and the exploit is publicly available.

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, an authenticated user with only users.edit permission can escalate their own privileges to admin by sending a PATCH request to /api/v1/users/{id} with permissions[admin]=1. The API controller only strips the superuser key from the permissions array, allowing admin and all other permission keys to be set by any user who can update users. This vulnerability is fixed in 8.4.1.

An authentication bypass vulnerability in code100x's Mobile API allows unauthenticated attackers to impersonate arbitrary users by sending a crafted JSON payload in the 'g' HTTP header.

Vulnerability in IBM Engineering Lifecycle Management versions 7.0.3, 7.1.0, and 7.2.0. An attacker with administrative privileges can execute remote code due to an improperly restricted method.

XML External Entity Injection (XXE) vulnerability in IBM Engineering Lifecycle Management versions 7.0.3 (Interim Fix 001-021), 7.1.0 (Interim Fix 001-009), and 7.2.0 and 7.2.0 Interim Fix 001. An authenticated attacker could exploit this to expose sensitive information or consume memory resources.

Privilege escalation via background service in OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges through a local IPC channel.