CVE Vulnerability Catalog

An improper protection of alternate path vulnerability in Palo Alto Networks Prisma® Browser on macOS fails to properly restrict access to an internal automation bridge. This allows a locally authenticated non-admin user to leverage an exposed communication channel to send unauthorized commands to the browser, bypassing security controls.

A vulnerability in Next.js from version 15.2.0 to 15.5.16 and 16.2.5 allows bypassing authorization checks in applications using App Router. Specially crafted .rsc and segment-prefetch requests can reach protected pages without passing through middleware rules.

Next.js versions from 15.4.0 to 15.5.15 and 16.2.0 to 16.2.4 contain a vulnerability that allows authorization bypass in applications using middleware to protect dynamic routes. Specially crafted query parameters can alter the dynamic route value seen by the page while leaving the visible path unchanged, enabling protected content to be rendered without passing the expected middleware check.

A vulnerability in Next.js allows unauthorized access to SSR data of protected pages by bypassing middleware. It affects versions from 12.2.0 to before 15.5.16 and 16.2.5 with i18n and middleware-based authorization configured.

A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move or access files belonging to other users on the same device.

A potential vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user on the local network to execute arbitrary commands on the device.

W GitHub Copilot CLI przed wersją 1.0.43 zidentyfikowano podatność, która pozwala na wykonanie dowolnego kodu przez złośliwe repozytorium git umieszczone w katalogu projektu. Wykorzystując automatyczne odkrywanie repozytoriów bare przez git podczas przeszukiwania katalogów, atakujący może ustawić klucze konfiguracyjne do uruchamiania dowolnych poleceń.

Aplikacja Claude Desktop przed wersją 1.3834.0 miała komponent CoworkVMService, który działał jako SYSTEM i nie weryfikował, czy katalog VM bundle był rzeczywistym katalogiem czy dowiązaniem NTFS. Lokalne, nieuprzywilejowane konto użytkownika mogło zastąpić katalog VM bundle dowiązaniem do wybranego przez atakującego miejsca, co prowadziło do tworzenia plików z uprawnieniami SYSTEM w dowolnym katalogu.

The urllib3 HTTP client library for Python versions 2.6.0 to before 2.7.0 contains a vulnerability where the entire response is decompressed instead of the requested portion during the second HTTPResponse.read(amt=N) call when using the official Brotli library, or after HTTPResponse.drain_conn() is called after partial read. This can lead to excessive resource consumption (high CPU usage and memory allocation) on the client side.

In protobufjs-cli prior to versions 1.2.1 and 2.0.2, there was a vulnerability that allowed the generation of unsafe JavaScript identifiers from schema-controlled names. When generating static JavaScript from a crafted schema or JSON descriptor, certain names could be written into the generated output without sufficient sanitization.

protobufjs before versions 7.5.6 and 8.0.2 generates JavaScript for the toObject function that may include an unsafe expression from a schema-controlled bytes field default value. A crafted descriptor can lead to arbitrary code execution.

Protobufjs before versions 7.5.6 and 8.0.2 lacks a depth limit when decoding nested protobuf data. A crafted binary payload can exhaust the JavaScript call stack, causing a crash.

Double-free of reply skb in net_shaper_nl_get_doit() and net_shaper_nl_cap_get_doit() functions. After genlmsg_reply() the skb is managed by netlink, and calling nlmsg_free() again on error leads to double free.

In the Linux kernel, a vulnerability was found in the SPS30 I2C air quality sensor driver. The sps30_i2c_read_meas() function used an incorrect buffer size (sizeof(size_t) instead of sizeof(__be32)), which could lead to out-of-bounds memory read.

A vulnerability exists in NGINX Plus and NGINX Open Source within the ngx_http_rewrite_module. It occurs when the rewrite directive is followed by rewrite, if, or set directives and an unnamed PCRE capture (e.g., $1, $2) with a replacement string containing a question mark (?). An unauthenticated attacker can send crafted HTTP requests, causing a heap buffer overflow in the NGINX worker process, leading to a restart.

In Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system.

A vulnerability has been identified that allows an authenticated attacker with the Resource Administrator or Administrator role to create SNMP configuration objects through iControl SOAP, resulting in privilege escalation.

When a Client SSL profile is configured with Allow Dynamic Record Sizing on a UDP virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.

CVE-2026-42409 affects the configuration of an HTTP/2 profile and an iRule containing the HTTP::redirect or HTTP::respond commands on a virtual server. Undisclosed requests can cause the Traffic Management Microkernel (TMM) process to terminate.

A vulnerability exists in BIG-IP and BIG-IQ systems that allows a highly privileged, authenticated attacker with the Certificate Manager role to modify configuration objects, enabling the execution of arbitrary commands.