CVE Vulnerability Catalog

The issue concerns improper memory handling, which may lead to unexpected process crashes when processing maliciously crafted web content. It has been fixed in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and watchOS 26.5.

A denial of service issue was addressed by removing the vulnerable code. An app may be able to modify protected parts of the file system.

The issue concerns improper input validation, which may lead to the Content Security Policy not being enforced. It has been fixed in Safari 26.5 and iOS 18.7.9.

This issue was addressed through improved state management. An attacker may be able to track users through their IP address.

A vulnerability in WebKit allows a process crash when processing maliciously crafted web content. The issue was fixed by improved memory handling in Safari 26.5, iOS 26.5, iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, and visionOS 26.5.

A vulnerability in WebKit allows a process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.

A use-after-free vulnerability in Safari and other Apple products may lead to an unexpected process crash when processing maliciously crafted web content. The issue was addressed with improved memory management.

This issue was addressed with additional entitlement checks. An app may be able to circumvent App Privacy Report logging.

A resource exhaustion issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.4 and iPadOS 26.4.

The issue was addressed with improved input validation. Local attacks may lead to modification of the Keychain state.

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7 and macOS Tahoe 26.5.

A vulnerability in WebKit allows a process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.

A buffer overflow was addressed with improved bounds checking. This issue is fixed in several versions of Apple operating systems.

A permissions issue was addressed with additional restrictions. An app may be able to gain root privileges.

A vulnerability was detected in inkeep agents version 0.58.14, affecting the function createDevContext in the file agents-api/src/middleware/runAuth.ts of the runAuth Middleware component. Manipulating this function results in authentication bypass using an alternate channel.

EDIMAX BR-6428nS V3 firmware version 1.15 is vulnerable to Command Injection. An authenticated attacker with network access can submit crafted input to the WLAN configuration functionality. Due to insufficient input validation, the attacker can execute arbitrary system commands on the device.

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue occurs when a CreateModelVersion request includes the tag mlflow.prompt.is_prompt, which bypasses source path validation. The get_model_version_artifact_handler() function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise.

Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries, including version 3.17.0 of the FreeImage library from 2017, which has known vulnerabilities.

Uncontrolled Resource Consumption vulnerability in the cow_http_te module of the ninenines cowlib allows for excessive resource allocation. An attacker can exploit this vulnerability by sending an HTTP/1.1 request with Transfer-Encoding: chunked and a very long hex string in the chunk-size field, leading to CPU exhaustion and memory amplification.

Crabbox before version 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path resolution. Attackers can supply absolute or relative paths that resolve outside the intended /workspace directory.