CVE Vulnerability Catalog

Use-After-Free (UAF) vulnerability in the web. Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in contacts. Impact: Successful exploitation of this vulnerability may affect availability.

Permission control vulnerability in calls. Impact: Successful exploitation of this vulnerability may affect availability.

The The7 theme for WordPress up to and including 14.3.2 is vulnerable to stored cross-site scripting via the 'dt_default_button' shortcode. This is due to insufficient input sanitization and output escaping on the 'title' component of the 'link' shortcode parameter. Authenticated attackers with Contributor-level access or above can inject arbitrary web scripts.

Improper cleanup of shared register resources in GPU firmware could allow an admin-privileged attacker from a Guest Virtual Machine (VM) to access these shared resources from another Guest VM, potentially resulting in the loss of confidentiality, integrity, or availability.

Improper handling of insufficient privileges in the AMD Secure Processor (ASP) could allow an attacker to provide an input value to a function without sufficient privileges and successfully write data.

Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or overwrite the contents of cross-chip debug (XCD) registers, potentially resulting in loss of data integrity or confidentiality.

Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when exporting table data from SMU to DRAM, potentially resulting in a loss of confidentiality and/or availability.

WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution. The default Cache::FileCache under /tmp/FileCache is created mode 0777 without a sticky bit, and entries are read back through Storable::thaw, allowing a local attacker to replace a response and escalate to code execution.

A System Management Mode (SMM) handler could perform a callout to code located in non-SMM/untrusted memory. A highly privileged attacker could, with active user interaction and under high complexity and present preconditions, trigger execution of attacker-controlled code in SMM, potentially compromising the system’s confidentiality, integrity, and availability.

Improper input validation in the AMD OverDrive (AOD) System Management Mode (SMM) module could allow a privileged attacker to perform an out-of-bounds read, potentially resulting in loss of confidentiality.

A stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server.

Hedera Guardian through version 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint. Unauthenticated attackers can retrieve sensitive user information including usernames, Hedera DIDs, system roles, and policy assignments.

MCP Registry prior to 1.7.6 binds the GitHub OIDC flow only to a global audience string, not to the specific registry instance. A token obtained for one deployment is accepted by any other deployment sharing the same code and audience, allowing improper publish permission assignment. Fixed in 1.7.6.

Prior to 1.1.3, the utcp-http plugin is vulnerable to blind SSRF due to a trust-boundary inconsistency between manual discovery and tool invocation; an attacker hosting a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare internal URLs that are then used without revalidation.

MCP Registry prior to 1.7.7 uses safeDialContext for HTTP-based namespace verification, but the blocklist does not cover IPv6 6to4, NAT64, or site-local addresses that can encode arbitrary IPv4 and tunnel to RFC1918 or cloud metadata services. This vulnerability is fixed in 1.7.7.

MCP Registry before 1.7.7 is vulnerable to stored cross-site scripting in the public catalogue UI (GET /) via the server.websiteUrl field of any published server.json. Server-side validation does not reject quote characters, and the value is interpolated into a double-quoted href attribute without proper encoding, allowing injection of arbitrary on* event handlers.

Inappropriate implementation in Chromoting in Google Chrome prior to 148.0.7778.168 allowed a local attacker to bypass discretionary access control via a malicious file. (Chromium security severity: Medium)

Inappropriate implementation in Views in Google Chrome on iOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page.

Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page.