CVE Vulnerability Catalog

The Mercusys AC12G (EU) V1 router enables WPS 2.0 by default with a weak lockout policy (60-second lockout after 10 attempts).

Mercusys AC12G (EU) V1 with firmware AC12G(EU)_V1_200909 transmits DDNS credentials over plaintext HTTP with only Base64 encoding. The firmware contains no TLS implementation, allowing man-in-the-middle interception of DDNS service credentials.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 is vulnerable to a HTTP denial of service via a low number of crafted incomplete HTTP requests, causing a persistent crash that requires physical power cycling to recover.

The Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 does not validate the HTTP Host header, enabling DNS rebinding attacks. An external attacker can rebind a domain to the router's internal IP address, extending the CORS wildcard vulnerability (Access-Control-Allow-Origin: *) to internet-originated attacks.

Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909 discloses kernel memory layout via the UPnP GetStatusInfo action. An unauthenticated attacker on the adjacent network can obtain a raw MIPS KSEG0 kernel pointer, revealing kernel memory layout and aiding further exploitation.

Dovestones Software ADPhonebook before v4.0.1.1 is vulnerable to a Cross Site Scripting vulnerability. The /Admin/Save API allows an authenticated admin user to store malicious JavaScript payloads in multiple configuration sections without proper input validation or output encoding.

A vulnerability in the web-based user interface of Cisco Webex Meetings could have allowed an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. Cisco has addressed this vulnerability in the Webex Meetings service, and no customer action is needed.

A vulnerability in Cisco Finesse could allow an unauthenticated, remote attacker to load arbitrary files from remote locations into an active user session, possibly leading to browser-based attacks. This is due to insufficient validation of user-supplied input for HTTP requests.

In the Linux kernel, in the panthor GPU driver, a bug occurs where failures in panthor_gpu_flush_caches() are not recovered from. When flush operations never complete, the driver does not schedule a reset, potentially leading to a hang. The fix adds reset scheduling and skipping subsequent flush operations after timeout.

In the Linux kernel PCI Endpoint subsystem, there is a missing NULL check for alloc_workqueue(). If allocation fails, a NULL pointer dereference may occur when queue_work() is called in epf_ntb_epc_init().

Dräger SC monitoring devices (models 6002XL, 6802XL, 7000, 8000, 9000 XL) in all software versions have a DoS vulnerability. An unauthenticated attacker can send a malformed network packet causing the monitor to reboot. Repeated attacks can disrupt patient monitoring until network connectivity is lost.

GLPI, a free IT asset management software, in versions 0.50 through 10.0.24 and 11.0.6 allows a technician to read arbitrary files inside the GLPI_DOC_DIR. This is fixed in versions 10.0.25 and 11.0.7.

The unicodedata.normalize() function can consume excessive CPU time when processing specially crafted Unicode input containing long runs of combining characters with alternating Canonical Combining Class values. This affects all normalization forms.

Cross-site scripting vulnerability in backpack/crud for Laravel. An attacker can conduct a targeted phishing campaign to trick users or admins into clicking a malicious link, which under very specific circumstances could lead to information disclosure or admin access.

The ProjectsAndPrograms school-management-system uses predictable credentials by generating student's and teacher's passwords solely from the user’s date of birth (e.g., 12072000 for 12 July 2000). The application does not require or prompt users to change the password upon first login. This behavior allows attackers to easily guess or derive valid credentials, leading to unauthorized account access.

ProjectsAndPrograms school-management-system is vulnerable to Stored Cross‑Site Scripting (XSS) in multiple attributes of students and teachers objects. An authorized attacker can inject malicious JavaScript that is subsequently executed in other users’ browsers. When chained with CVE‑2025‑11661, it can be exploited remotely without privileges.

Daphne before version 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Since Autobahn defaults both to 0 (unlimited), an unauthenticated remote attacker can send arbitrarily large WebSocket frames or messages, causing excessive memory consumption and denial of service.

An out-of-bounds read vulnerability exists in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.0 library. Insufficient validation of extent header fields before performing a binary search can lead to invalid pointer calculations and out-of-bounds memory read during extent tree traversal.

A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by providing a malformed ext4 filesystem image that results in a zero logical block size.

In GPAC Project/MP4Box before version 26.02.0, a NULL pointer dereference exists in the gf_filter_pid_resolve_file_template_ex function in /filter_core/filter_pid.c. An attacker can supply a crafted file to cause a Denial of Service (DoS).