CVE Vulnerability Catalog

IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.

The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default. This may allow man-in-the-middle attacks and interception of data transmitted in that WebView.

Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it. This may lead to interception of data transmitted without encryption.

Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages. This may lead to man-in-the-middle attacks and data theft.

The Joyland AI app accepts any TLS certificates from any server without validation. This means network connections are not secure and can be eavesdropped or modified by an attacker.

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed app has been granted permissions previously, the attacker can access the entire file system, camera, microphone, and GPS tracking.

The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications with arbitrary content to any user, group of users, or all users at once.

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.

A stack-based buffer overflow vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Deco M9 Plus due to insufficient validation of decrypted request data length before it is copied into a fixed-size stack buffer in the subtype 0x91 handler. Successful exploitation may allow an adjacent, unauthenticated attacker to cause a denial of service or achieve arbitrary code execution during the device setup phase through crafted TDDP packets.

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result in complete device compromise through arbitrary command execution with root privileges.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

This CVE has been rejected or withdrawn by its CVE Numbering Authority.

Vvveb prior to version 1.0.8.6 contains an SSRF vulnerability because host validation only handles IPv4, not IPv6. An authenticated admin-panel user can exploit the oEmbed proxy to read internal services and cloud metadata, including IAM credentials.

Vvveb prior to version 1.0.8.6 has a flawed path sanitizer that allows an authenticated user with backup access to read and delete arbitrary files on the server. This can expose database credentials, read system files, and delete config/db.php to enable full site takeover.

Vvveb prior to version 1.0.8.6 has an HTML sanitizer that fails to strip event-handler attributes when a tag contains a greater-than character inside a quoted attribute value. A low-privilege content author can store malicious JavaScript that executes in browsers of visitors and administrators, potentially leading to admin account takeover.

DHIS2 versions from 2.42.0 to before 2.42.5.1, and from 2.43.0 to before 2.43.0.1, are vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.

A vulnerability in Johnson Controls Easy IO FG before version 2.0b52 involves improper privilege management, allowing brute force attacks. This means an attacker can repeatedly try to guess passwords or other credentials.

The Confluent Kafka Python client's HashiCorp Vault KMS integration has improper TLS certificate validation, which could allow a remote attacker to obtain sensitive information.

Lektor 3.3.14 and 3.4.0b15 contains a CSRF vulnerability in the admin API blueprint that allows unauthenticated attackers to perform state-changing actions such as writing files, deleting pages, wiping build output, and triggering publication, by sending requests from malicious web pages.