CVE Vulnerability Catalog

In the omec-project amf up to version 2.1.1, a vulnerability was found in the NGReset Message Handler component that leads to memory corruption. The attack can be carried out remotely and the exploit has been published.

In the omec-project amf up to version 2.1.1, a vulnerability was found in the NGSetupRequest Handler component that leads to memory corruption. The attack can be carried out remotely and the exploit has been disclosed.

In the omec-project amf up to version 2.1.1, a vulnerability was found in the PDUSessionResourceModifyIndication function of the file /go/src/amf/ngap/handler.go that leads to memory corruption. The attack can be carried out remotely and the exploit has been published.

A vulnerability was found in the PathSwitchRequest Handler component of omec-project amf up to version 2.1.1, leading to memory corruption. The attack can be launched remotely and the exploit is publicly available.

A command injection vulnerability was identified in Edimax BR-6428NS version 1.10 in the formWlbasic function of the /goform/formWlbasic file. An attacker can remotely manipulate the repeaterSSID argument, leading to arbitrary command execution. The exploit has been publicly disclosed and may be used.

A command injection vulnerability has been found in Edimax BR-6428NS version 1.10 in the system function of the /goform/formWlanM file. The attack can be launched remotely by manipulating multiple arguments.

In M365 Copilot, a command injection vulnerability exists due to improper neutralization of special elements used in a command. An unauthorized attacker can disclose information over a network.

In Mermaid up to version 10.9.5 and from 11.0.0-alpha.1 to 11.14.0, there is an HTML injection vulnerability under default configuration. The classDef directive in state diagrams permits DOM injection outside the SVG context, though <script> tags are stripped, preventing XSS.

CSS injection vulnerability in Mermaid up to version 10.9.5 and 11.0.0-alpha.1 through 11.12.0. Improper sanitization in the createCssStyles parser allows CSS injection, leading to page defacement, user tracking, or DOM attribute exfiltration.

RT (Request Tracker) versions before 5.0.10 and 6.0.0 through 6.0.2 contain a spreadsheet (CSV/formula) injection vulnerability. User-controlled data in spreadsheet exports is not sanitized before being written to the output file, which can cause spreadsheet applications to interpret crafted values as formulas or macros when the file is opened.

An out-of-bounds read vulnerability has been found in libheif versions 1.21.2 and prior during HEIF sequence parsing. A malformed file can cause denial of service (DoS).

JupyterHub versions 4.1.0 through 5.4.4 inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. This affects only HTTP form endpoints, allowing attackers to trigger server spawn and, if the attacker is a JupyterHub user with share permissions, force a user to accept a share and gain access to the attacker's server.

In BentoML versions 1.4.38 and prior, the build packaging workflow follows attacker-controlled symlinks inside the build context and copies the referenced file contents into the generated Bento artifact. An attacker can place a symlink pointing to a sensitive local file, which gets packaged into the Bento.

Mantis Bug Tracker (MantisBT) versions 2.28.1 and below have a vulnerability due to improper escaping of the redirection page from the Referer header, allowing HTML injection. On specific server configurations, this could lead to cache poisoning and cross-site scripting.

In Devise versions 5.0.3 and below, with Timeoutable enabled, FailureApp#redirect_url returns the HTTP Referer header without validation for non-GET requests on session timeout. An attacker can redirect victims to arbitrary external URLs.

TypeBot, a chatbot builder tool, in versions 3.16.0 and prior does not verify the x-hub-signature-256 HMAC signature in WhatsApp Cloud API webhooks. Additionally, workspaceId and credentialsId are exposed in logs and Meta dashboard, allowing unauthenticated attackers to send spoofed webhook messages, trigger bots, and consume API resources.

In TypeBot versions up to 3.15.2, the getLinkedTypebots API endpoint returns full bot definitions to any authenticated user referencing a bot ID from another workspace, leading to IDOR. The access control is ineffective due to using Array.filter() with an async callback. Fixed in version 3.16.0.

Vulnerability in Arm ArmNN through 2026-03-27. An integer overflow in TensorShape::GetNumElements() allows bypassing buffer size validation and heap-based buffer over-read.

In TypeBot prior to version 3.16.0, the viewer renders anchor tags from rich text bubble content without filtering the javascript: URI scheme. A bot author can set a link URL to javascript:PAYLOAD, which executes in the visitor's browser context.

HP ENVY 5000 series printers with firmware VERBASPP1N003.2237A.00 do not properly manage concurrent TCP connections to port 9100 (JetDirect/RAW). An unauthenticated remote attacker on the same network can establish a persistent connection and send keep-alive packets, locking session threads. Lack of connection timeouts and session limits results in a persistent denial of service requiring physical intervention (manual restart) to restore functionality.