CVE Vulnerability Catalog

CVE-2026-8954 involves incorrect boundary conditions and integer overflow in the Audio/Video component. This issue has been fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

The vulnerability allows privilege escalation in the Application Update component. It was fixed in Firefox 151 and Thunderbird 151.

Integer overflow in the Widget: Win32 component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Use-after-free vulnerability in the DOM: Bindings (WebIDL) component of Firefox and Thunderbird. The flaw was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

A vulnerability in the Web Codecs component of Firefox and Thunderbird is caused by incorrect boundary conditions, potentially leading to unexpected behavior. The flaw is fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

A sandbox escape vulnerability in Firefox and Firefox Focus for Android. This flaw was fixed in Firefox 151.

Nieprawidłowe przetwarzanie syntaktycznie niepoprawnej struktury w Sparx Pro Cloud Server umożliwia przeprowadzenie ataku typu Denial of Service (DoS) poprzez wysłanie specjalnie przygotowanego zapytania SQL. To powoduje niespodziewane zakończenie działania usługi Pro Cloud Server.

Sparx Pro Cloud Server jest podatny na warunek wyścigu w punkcie końcowym /data_api/dl_internal_artifact.php. Aplikacja pobiera właściwości obiektu wskazywanego przez parametr guid i zapisuje załadowaną zawartość w bieżącej lokalizacji (__DIR__) pod określoną nazwą, co pozwala atakującemu na stworzenie złośliwego pliku PHP.

Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior and log in as any other user or administrator, allowing for any changes to the repository.

Sparx Pro Cloud Server wymaga uwierzytelnienia opartego na żądanym URL. Atakujący może pominąć parametr zapytania 'model' i przesłać nazwę modelu tylko w binarnym obiekcie w żądaniu POST, co pozwala na wykonanie zapytania SQL bez uwierzytelnienia.

Sparx Pro Cloud Server jest podatny na problem z naruszeniem kontroli dostępu w komunikacji z bazą danych. Z powodu braku sprawdzeń uprawnień, każdy użytkownik o niskich uprawnieniach może wykonywać dowolne zapytania SQL w kontekście użytkownika bazy danych.

CVE-2026-23558 describes a race condition that occurs during the grant table version change from v2 to v1 in HVM or PVH guests. This issue may lead to some status pages being freed while their mappings are still being inserted into the guest's page tables.

The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to and including 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated 'post_cg_gallery_form_upload' AJAX action.

W Keycloak znaleziono lukę, która pozwala użytkownikowi o niskich uprawnieniach, znającemu dane logowania i identyfikator klienta, na obejście zabezpieczenia mającego na celu wyłączenie domyślnego przepływu w klientach OpenID Connect (OIDC). Manipulując danymi klienta podczas ponownego uruchamiania sesji, atakujący może uzyskać dostęp do tokena, który nie powinien być dostępny.

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker can pre-create an authentication session and trick a victim into clicking a malicious link, allowing the attacker to hijack the required-action form without the victim's credentials. Successful exploitation could lead to complete account takeover, including highly privileged administrative accounts.

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.

A flaw was found in Keycloak where a remote, unauthenticated attacker can send a specially crafted XML input to the SAML endpoint, causing high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) and server unavailability.

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation.

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server.

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the 'Date Menu of news articles' plugin.