CVE Vulnerability Catalog

In Modem, a missing bounds check could lead to an out-of-bounds read, allowing remote denial of service if the UE connects to a rogue base station controlled by the attacker. No additional privileges or user interaction are needed.

In the WLAN AP driver, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation.

BaserCMS contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed.

In Bouncy Castle for Java before 1.85, the BKS keystore accepts a legacy version with a 16-bit integrity MAC key. This also affects Bouncy Castle for Java LTS before 2.73.12.

In Bouncy Castle for Java before 1.85, the OpenPGP user-attribute subpacket length is bounded only by JVM max memory. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the DTLS handshake reassembler allocates a buffer from an unchecked 24-bit length. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the OER parser recurses without depth limit on self-referential IEEE 1609.2 schema. This also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specified versions.

In Bouncy Castle for Java before 1.85, the MLS hash-ratchet honors an arbitrary 32-bit generation counter from the sender.

In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures are silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13.

In Bouncy Castle for Java before 1.85, CMS AuthenticatedData content is not bound to MAC when authAttrs are present. This issue also affects Bouncy Castle for Java LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the CMS verifySignatures method returns true for SignedData with zero signers. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, PKCS#8 / PBES2 decryptors honor an unbounded KDF cost from input. This also affects LTS before 2.73.12 and FIPS versions before specific bcpkix-fips releases.

In Bouncy Castle for Java before 1.85, the BKS/UBER keystore allocates memory from untrusted lengths before integrity check. This issue also affects LTS before 2.73.12.

A deserialization vulnerability in PRISMAproduction version 6.5 or earlier that may lead to arbitrary code execution.

In the OCPP 1.6 client in Zephyr RTOS, a vulnerability was found involving out-of-bounds buffer read during WAMP RPC frame parsing. The extract_string_field() function uses strncpy without guaranteed null-termination, leading to reads beyond the 128-byte buffer and potential out-of-bounds null write. The vulnerability can be remotely exploited by a malicious central server or an on-path attacker.

Hugging Face Transformers up to version 5.8.0.dev0 has an arbitrary file write vulnerability via path traversal in save_pretrained(). Keys from chat_template are used as filenames without validation.

Vikunja versions 0.22.0 through 2.3.0 fail to validate the principal type in API token management. A link-share JWT with a matching ID can be used to manage another user's tokens.

FreeRDP before 3.29.0 has integer overflows in the audin channel across ALSA, sndio, WinMM, and OpenSL ES backends. A malicious server can supply a FramesPerPacket value causing allocation size wraparound.

ArcadeDB before 26.7.3 fails to bind the authenticated principal in MCP HTTP transport, causing all engine permission checks to be bypassed. MCP users can perform arbitrary writes, DDL, schema mutations, and JavaScript code execution.