CVE Vulnerability Catalog

In libheif before version 1.22.0, when decoding a HEIF grid image with strict_decoding=false, a corrupted tile silently fails and the library returns heif_error_Ok with no indication of failure, leading to an uninitialized heap memory information leak. The Y, Cb, and Cr planes are not zeroed, so heap data appears in pixel values.

Joplin, an open-source note-taking and to-do application, versions 3.6.14 and prior, contains a Denial of Service (DoS) vulnerability in the note title input due to missing length validation. An attacker can cause an Out Of Memory (OOM) error and program termination by inserting an excessively long string into a note's title, either via the UI or through the local web service API (port 41184) after compromising an authentication token. The issue is fixed in version 3.7.1.

In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a conn_id containing a '/' (e.g. 'my_team/conn') to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could retrieve another team's secret by crafting a colliding conn_id. Fixed in 9.28.0 by switching the team-scope separator to '--' and rejecting team-shaped conn_ids when team context is absent. Affects the experimental multi-tenant teams feature only.

libheif versions 1.21.2 and below are vulnerable to a DoS attack via an infinite loop in Box_stts::get_sample_duration(). A crafted 800-byte HEIF file causes 100% CPU usage with no progress, leading to denial of service. The issue occurs during file opening, before any user interaction.

Authorization bypass vulnerability in the Kirki plugin for WordPress up to version 6.0.6. Allows authenticated attackers with subscriber-level access or higher to view all Kirki frontend forms and read stored visitor submission data, including contact details and messages.

LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from unauthenticated connections. Attackers who obtain a valid Session token can issue PLAY and TEARDOWN commands from a second TCP connection without authentication, causing server crashes through virtual function call errors or disrupting active streams by terminating victim sessions.

Discourse prior to versions 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 contains a vulnerability in the discourse-subscriptions plugin that allows users to gain access to subscription-gated groups without completing payment.

EspoCRM versions 9.3.3 and below allow authenticated users to upload SVG attachments through normal attachment-capable fields and later serve those SVG files as top-level inline documents, resulting in stored cross-user XSS. Although inline SVG script is blocked by CSP, same-origin external script is allowed, so an attacker can upload a malicious SVG together with a second attacker-controlled JavaScript attachment and trick another user into opening the SVG to execute JavaScript.

In libheif (versions 1.21.2 and below), a crafted HEIF file with samples_per_chunk=0 in the stsc box causes an unsigned integer underflow in the Chunk constructor, leading to an out-of-bounds read and crash (SEGV) on the first frame access. The file parses without error, but crashes when attempting to display.

NULL pointer dereference vulnerability in NanoMQ MQTT Broker versions 0.24.10 and below during high-concurrency reconnect traffic. Causes broker crash (DoS) without authentication. Fixed in version 0.24.11.

A command injection vulnerability in Panabit PAP-XM320 up to V7.7. The management interface calls /usr/sbin/pappiw with user-controlled parameters processed by eval, allowing arbitrary shell command execution.

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another app on the same device to request arbitrary URLs and receive responses with the signed-in user's cookies. Fixed in Firefox for iOS 151.0.

Technitium DNS Server before version 15.0 aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker controlling a domain can cause excessive network traffic.

An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors. On Windows, a symbolic link vulnerability allows a local low-privileged user to escalate privileges to Administrator. During installation, the software writes the file CCFLFamily_07Feb11.edr to C:\ProgramData\Portrait Displays\CW\data\i1D3\ while running with elevated privileges. Because the installer does not properly validate symbolic links or reparse points at the destination path, an attacker can create a malicious link that redirects the write operation to an arbitrary system location, enabling arbitrary file creation or overwrite with elevated privileges.

A same-origin policy bypass exists in the Networking: JAR component of Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

A Spoofing vulnerability in the Form Autofill component of Firefox and Thunderbird. The issue was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

A spoofing issue exists in the Toolbar component in Firefox for Android. This vulnerability was fixed in Firefox 151.

Any guest can cause xenstored to crash by issuing an XS_RESET_WATCHES command within a transaction due to an assert() triggering. If xenstored was built with NDEBUG defined, nothing bad will happen, as assert() does nothing in that case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen.

A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter. An authenticated user with limited privileges can push malicious remote strategies containing HTML tags, which render in the victim's browser.

A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter. An authenticated user with administrative privileges can define a malicious restore schedule containing HTML tags.