CVE Vulnerability Catalog

In Vaultwarden, prior to version 1.35.4, there is a vulnerability that allows bypassing brute-force login protection if email 2fa is enabled. The 2fa function send_email_login acts as an oracle, enabling attackers to test username-password combinations without rate limiting.

Vaultwarden, a Bitwarden-compatible server, prior to version 1.35.5 allowed an unconfirmed organization owner to purge the entire organization vault. The organization invite flow did not verify confirmation status, enabling a user invited as an owner to delete data.

Vaultwarden prior to version 1.35.5 does not verify that user and group entries belong to the same organization, allowing unauthorized access to vault data of another organization.

In barebox bootloader prior to version 2026.04.0, multiple memory-safety vulnerabilities exist in the EFI PE loader (efi/loader/pe.c). Integer overflow in virtual image size calculation and missing validation of PointerToRawData lead to undersized heap allocation and out-of-bounds heap read. An attacker can supply a malicious EFI PE binary via TFTP, USB, SD card, or network boot, potentially causing heap buffer overflow and code execution in bootloader context.

Link Preview JS prior to version 4.0.1 did not check for IPv6 loopback attacks and DNS attacks, which could lead to internal data leaks.

The vulnerability in exiftool-vendored before version 35.19.0 allows argument injection into ExifTool by not rejecting newline characters in supplied strings. This can lead to a single intended argument being split into multiple arguments, creating a risk of argument manipulation.

Outline is a service that allows for collaborative documentation, which in versions from 0.84.0 to 1.7.0 has an authorization issue in the subscriptions.create API endpoint. When both collectionId and documentId are supplied, authorization only checks collectionId, allowing an attacker to pin a subscription to a document they do not have access to.

The Outline service, allowing collaborative documentation, had a vulnerability in the ZipHelper.extract function prior to version 1.7.0, which incorrectly computed the extraction path for zip entries. For long paths, this function dropped all directory components, leading to files being opened in the wrong location.

Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, the comment section permits users to mention other users; however, the backend does not validate or sanitize the href attribute associated with these mentions, potentially leading to client-side code execution.

Outline is a service that allows for collaborative documentation. From versions 0.84.0 to 1.6.1, a logic error in OAuthInterface.validateScope() allows the entire scope array to be accepted if any single scope is valid.

WWBN AVideo is an open source video platform that, in versions up to 29.0, allows unauthenticated users to read APISecret from objects/plugins.json.php. This enables them to call protected API endpoints, such as users_list, without logging in.

AVideo is an open source video platform that is vulnerable to SSRF attacks in versions up to 29.0. Two endpoints improperly validate user-supplied URLs, allowing an attacker to redirect to internal resources.

AVideo is an open-source video platform that, in versions up to 29.0, exposes the local CloneSite shared secret in the HTTP response to every unauthenticated request. This secret can be exploited by an attacker to impersonate the victim and gain access to the remote database.

In the jotty·page application prior to version 1.22.0, there is an unauthenticated path traversal vulnerability in the /api/app-icons/[filename] endpoint. The filename route parameter is joined into a filesystem path without validation, allowing file reads outside the allowed directory.

In the libcaca library version 0.99.beta20 and earlier, there is an integer overflow vulnerability in the canvas import functionality, allowing an attacker to cause a controlled heap out-of-bounds write. This may lead to memory corruption or remote code execution.

AVideo is an open-source video platform that has a vulnerability in versions up to 29.0 allowing an unauthenticated attacker to send malicious messages via WebSocket. This vulnerability arises from improper JSON data handling, enabling PHP code execution on the server.

A use after free issue was addressed with improved memory management. This issue is fixed in several versions of Apple operating systems.

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.5, tvOS 26.5, watchOS 26.5. Processing a maliciously crafted image may corrupt process memory.

A validation issue was addressed with improved logic. This issue may have prevented Content Security Policy from being enforced.

A vulnerability in WebKit that could lead to an unexpected Safari crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.