CVE Vulnerability Catalog

A null pointer dereference vulnerability in WatchGuard Fireware OS allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by sending specially crafted IKEv2 messages. This affects both Mobile User VPN with IKEv2 and Branch Office VPN using IKEv2 when configured with a dynamic gateway peer.

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client for Windows allows a local attacker to escalate their privileges to NT AUTHORITY\SYSTEM on the machine where the client is installed. This issue affects the Mobile VPN with SSL client for Windows up to and including version 2026.2.

A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS's CLI could allow an authenticated privileged user to execute arbitrary code via a specially crafted CLI command.

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS networkd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.

A vulnerability in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network due to incorrect authorization.

In Libreswan, the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa() incorrectly verifies the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload uses RSASSA-PKCS1-v1_5. A remote attacker can exploit a Bleichenbacher-style attack to forge the AUTH payload, leading to impersonation, or trigger an assertion causing denial-of-service.

Libreswan has a vulnerability in the RSA_authenticate_hash_signature_raw_rsa() function that incorrectly verifies the authentication hash length in IKEv1 packets using PKCS #1 RSA encoding. A remote attacker can forge the SIG payload via a Bleichenbacher-style attack, leading to impersonation, or cause denial-of-service by sending a shorter hash.

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. An off-by-one error in the PASSERT assertion leads to daemon abort.

The react-native-receive-sharing-intent library contains a path traversal vulnerability that allows a malicious app to write files outside the intended cache directory by supplying a crafted _display_name value with dot-dot path components. Attackers can send an ACTION_SEND intent to the exported share-receiver activity to overwrite arbitrary files in the app's private data directory, including databases, shared preferences, and cached configuration.

A vulnerability in the UTT nv518G router with firmware version nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_445C5C component.

A buffer overflow vulnerability in the UTT nv518G router (firmware version nv518GV3v3.2.7-210919-161313) allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_444C8C component.

A buffer overflow vulnerability in UTT nv518G device (firmware version nv518GV3v3.2.7-210919-161313) allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_487330 component.

Notepad3 up to version 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibrary(L"MSFTEDIT.DLL") with a bare DLL name, allowing a local attacker to place a malicious MSFTEDIT.DLL in the application directory or another preferred DLL search location and achieve arbitrary code execution in the context of the user when the About dialog is opened.

A denial-of-service vulnerability in pdfcpu up to version 0.11.1 is caused by uncontrolled recursion in the PDF parser. Functions ParseObjectContext() and parseArray() in parse.go recursively process nested PDF objects without enforcing a maximum nesting depth, potentially leading to stack overflow.

A vulnerability in Dapr Sentry allows a remote unauthenticated attacker to poison the OIDC discovery document by manipulating the X-Forwarded-Host header. Relying parties performing dynamic discovery may fetch JWKS from an attacker-controlled server, leading to acceptance of forged JWT tokens.

LobeChat before version 2.2.10-canary.18 contains a server-side request forgery (SSRF) vulnerability. An authenticated attacker can direct internal HTTP requests to arbitrary URLs by exploiting the skill import (importFromUrl) and topic cover update (fetchImageFromUrl) endpoints, which use the global fetch without the ssrf-safe-fetch wrapper.

Pathway through 0.31.1 (fixed in commit d09722e) allows a remote unauthenticated attacker to cause a denial of service by sending a short glob pattern with many ** tokens to the /v1/retrieve, /v1/inputs, or /v2/answer HTTP endpoints. The recursive matcher without memoization leads to exponential time complexity, consuming CPU for tens of seconds per request.

In Weaviate before version 1.38.0, there is no verification that a principal assigning an RBAC role holds the permissions granted by that role. A user with the delegated assign_and_revoke_users or assign_and_revoke_groups permission can assign the built-in admin role to themselves or others, leading to privilege escalation to full database control.

JuiceFS up to version 1.3.1 contains an authentication bypass vulnerability. An unauthenticated remote attacker can access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. The attacker can retrieve the process command line containing metadata engine connection strings with database credentials, gaining full read/write access to the filesystem metadata.