CVE Vulnerability Catalog

Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by an Improper Input Validation vulnerability. A successful attacker can abuse this to achieve session takeover, significantly impacting confidentiality and integrity.

In the Linux kernel TLS, handling of zero-length records on the rx_list is flawed. When the initial record comes from rx_list and is zero-length, it can break processing logic as zero-length records should not be zero-copied.

In multiple locations, there is a possible way to escape the Chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed and no user interaction required for exploitation.

Deserialization of Untrusted Data vulnerability in Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Code Injection. This issue affects Experience Manager (XM): through 9.0; Experience Platform (XP): through 9.0.

An authenticated remote command execution (RCE) vulnerability exists in the Parental Control page on TP-Link Archer C7(EU) V2 and TL-WR841N/ND(MS) V9. This issue affects Archer C7(EU) V2 before 241108 and TL-WR841N/ND(MS) V9 before 241108, and both products have reached end-of-life (EOL) status.

Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, and WhatsApp for Mac v2.25.21.78 could have allowed an unrelated user to trigger processing of content from an arbitrary URL on a target's device. This vulnerability, combined with an OS-level vulnerability on Apple platforms (CVE-2025-43300), may have been exploited in a sophisticated attack against specific targeted users.

FreePBX, an open-source graphical user interface, has vulnerabilities in versions 15, 16, and 17 due to insufficiently sanitized user-supplied data. This allows unauthenticated access to the FreePBX Administrator, leading to arbitrary database manipulation and remote code execution.

Memory overflow vulnerability leading to Remote Code Execution and/or Denial of Service in NetScaler ADC and NetScaler Gateway when NetScaler is configured as Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server, or in specific LB and CR virtual server configurations with IPv6 services.

Wykryto problem z zapisem poza dozwolonym zakresem, który został rozwiązany poprzez poprawę sprawdzania granic. Problem ten został naprawiony w kilku wersjach systemów iOS, iPadOS oraz macOS. Przetwarzanie złośliwego pliku graficznego może prowadzić do uszkodzenia pamięci.

Improper Input Validation vulnerability in N-able N-central allows OS Command Injection. This issue affects N-central before 2025.3.1.

Deserialization of untrusted data vulnerability in N-able N-central allows local code execution. Affects versions before 2025.3.1.

WinRAR for Windows has a path traversal vulnerability that allows attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild.

Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass security mechanisms and execute code without user interaction.

A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and execute commands on affected installations.

A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application.

An improper control of code generation (code injection) vulnerability in DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to execute arbitrary code.

A vulnerability in WebKit allows memory corruption when processing maliciously crafted web content. The issue was fixed by improving memory handling in Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

A race condition was found in the Linux kernel between handle_posix_cpu_timers() and posix_cpu_timer_del(). An exiting non-autoreaping task can be reaped by its parent after unlock_task_sighand(), causing synchronization issues.

Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware of an exploit in the wild and is preparing an update.

eslint-config-prettier versions 8.10.1, 9.1.1, 10.1.6, and 10.1.7 contain embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.