CVE Vulnerability Catalog

VOCALOID6 has a missing authentication for a critical function. Any process running under the same local user account as a running VOCALOID6 Editor instance may escalate privileges via a local named pipe.

This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts.

OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (SSRF).

TREK before 3.1.0, when the Journey add-on is enabled, interpolates the unescaped activeSuggestion.title value into suggestion text and renders it with dangerouslySetInnerHTML. A trip owner can store HTML in a title, which is executed in a collaborator's session.

SFTPGo from 2.2.0 to 2.7.3, the inline query parameter on file downloads suppresses Content-Disposition: attachment, allowing attacker-controlled HTML files to be served as text/html in the web origin.

Tor before 0.4.9.9 can enter an infinite loop when decompressing a truncated zlib/gzip stream with done=1. The truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR, which is mistaken for a full output buffer.

libvips before 8.18.3, built with libultrahdr support, can incorrectly size an output buffer in uhdrsave.c when a pipeline enlarges an incoming JPEG to a very large output before encoding a gain map. This can cause a heap buffer over-read.

In lin-snow Ech0 up to 5.4.1, a vulnerability exists in the MD5Encrypt function in internal/util/crypto/crypto.go. The use of a risky cryptographic algorithm can be exploited remotely, though the attack complexity is rather high.

SecureDrop Client before 1.3.1 can be tricked by a malicious SecureDrop Server responding with cross-origin redirects, bypassing securedrop-proxy's origin limitation.

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to follow a substituted final symlink when opening a path with O_TRUNC instead of enforcing FinalSymlink::DontFollow, allowing the Nix process or nix-daemon to create or truncate an empty file outside the build sandbox with the daemon user's permissions. The primitive does not provide arbitrary-content writes and requires winning the race. This issue is fixed in version 2.35.0.

A vulnerability in Sony XAV-9500ES devices allows physically present attackers to bypass authorization by connecting a crafted USB device. The flaw exists in the udev rules, which can trigger instantiation of restricted USB device types. Authentication is not required to exploit this vulnerability.

A vulnerability in Sony XAV-9500ES devices allows physically present attackers to execute arbitrary code in the context of the gpsd daemon. The flaw is due to improper validation of NMEA data length before copying to a fixed-length buffer, leading to a buffer overflow. Authentication is not required.

A vulnerability in Sony XAV-9500ES devices allows network-adjacent attackers to disclose sensitive information via an out-of-bounds read when handling Bluetooth L2CAP packets. The attacker must first pair a malicious Bluetooth device with the target system.

A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE option is enabled. This can lead to unauthorized file access and disclosure of filesystem structure. The product is no longer actively supported and the vulnerability has not been fixed.

An incorrect authorization vulnerability in frozen BI aggregations in Checkmk (versions <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0) allows an authenticated user with restricted host and service visibility to learn the names and existence of hosts and services they are not authorized to see.

Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. Details of affected products and versions are available in the vendor's information.

The GutenKit WordPress plugin before version 2.5.0 lacks sufficient capability checks on some REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account.

BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.

Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service.