CVE Vulnerability Catalog

XSS vulnerability in Message Filter for Contact Form 7 up to version 1.6.3.9. An unauthenticated attacker can inject malicious JavaScript.

XSS vulnerability in Spam protection, AntiSpam, FireWall by CleanTalk up to version 6.82. An unauthenticated attacker can inject malicious JavaScript.

XSS vulnerability in miniorange otp verification up to version 5.5.1. An unauthenticated attacker can inject malicious JavaScript.

SSRF vulnerability in Simple Link Directory Pro up to version 15.0.6. An unauthenticated attacker can make the server send requests to internal network resources.

An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension.

Vulnerability in React Router versions 7.0.0 through 7.17.0. Unauthenticated requests to the manifest endpoint can overload the server and slow down responses. This does not affect applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>).

An issue in Dede CMS version 5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the file_manage_control.php component.

SQL injection vulnerability in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the sqlquery parameter of the sys_sql_query.php component.

Quest KACE SMA 11.0.273 ships with default credentials for the kbftp account (password getbxf), which is publicly known. A remote attacker can gain privileged access to the FTP service containing MySQL backups with sensitive data.

Quest KACE SMA 11.0.273 ships with default credentials for the MySQL accounts report and R1 (password box747), which is publicly known. A remote attacker can gain privileged access to MySQL databases containing sensitive data.

A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.6, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.

An out-of-bounds read vulnerability that could allow a remote attacker to cause unexpected app termination. The issue was addressed with improved input validation.

An integer overflow was addressed with improved input validation. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

An integer overflow was addressed with improved input validation. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

An out-of-bounds write vulnerability in Apple systems. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

An out-of-bounds write vulnerability in Apple systems, fixed by removing the vulnerable code. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution.

A vulnerability in Apple products (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) due to insufficient bounds checks when processing files. Processing a maliciously crafted file may lead to unexpected app termination.

A memory corruption issue was addressed with improved state management. Processing maliciously crafted web content may lead to an unexpected Safari crash.

A vulnerability in Apple systems related to improper memory handling. An app may be able to cause unexpected system termination or corrupt kernel memory.

A buffer overflow was addressed with improved size validation. An app may be able to execute arbitrary code with kernel privileges.