CVE Vulnerability Catalog

A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software allows a malicious authenticated administrator to store a JavaScript payload via the web interface.

Multiple improper certificate validation vulnerabilities in the Palo Alto Networks GlobalProtect app allow an attacker to intercept encrypted communications and potentially compromise the endpoint. A local non-administrative OS user or an attacker on the same subnet can redirect traffic to an unauthorized server and facilitate malicious software installation. The GlobalProtect app on Linux, Windows, iOS, and GlobalProtect UWP are not affected.

An improper certificate validation vulnerability in the Prisma Access Agent for Android and Chrome OS allows a man-in-the-middle (MitM) attack to intercept VPN traffic. By presenting a certificate for any domain issued by a trusted Certificate Authority, the attacker can capture sensitive device information.

Multiple information disclosure vulnerabilities in Prisma Access Agent allow a local user to access sensitive configuration data and credentials. The vulnerability affects the agent on Windows and macOS systems.

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploitation could allow an attacker to read sensitive data, modify database contents, and escalate privileges to gain full administrative control of the platform.

An information disclosure vulnerability in Chronosphere Chronocollector allows an unauthenticated attacker with network access to the collector service to retrieve sensitive information.

A race condition vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated non-admin user to bypass certain access and data control policies.

Next.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. Malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors.

Next.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. Serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser.

In vm2 prior to 3.11.0, the code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable, exposing internal security functions (handleException, wrapWith, import). This vulnerability is fixed in 3.11.0.

In vm2 prior to 3.11.0, the CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0.

In vm2 prior to 3.11.0, a sandbox boundary violation allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity, allowing the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state.

Next.js versions from 10.0.0 to before 15.5.16 and 16.2.5, when self-hosted with the default image loader, do not enforce a maximum size limit for local assets fetched by the Image Optimization API. An attacker can request large files via the /_next/image endpoint, causing out-of-memory conditions.

In Next.js applications using React Server Components from 14.2.0 to before 15.5.16 and 16.2.5, shared caches that do not correctly partition response variants can be poisoned. An attacker can cause an RSC response to be served from the original URL so later visitors receive component payloads instead of expected HTML.

A command injection vulnerability was discovered in TeamViewer DEX Platform On-Premises (formerly 1E DEX Platform On-Premises) prior to version 9.2. Improper input validation allows authenticated users with at least questioner privileges to inject commands in specific instructions, potentially leading to execution of elevated commands on devices connected to the platform.

Buffer Overflow vulnerability in Ardupilot rover commit v.c56439b045162058df0ff136afea3081fcd06d38 allows a local attacker to cause a denial of service via the AP_InertialSensor_ADIS1647x.cpp, ArduRover, ADIS1647x Sensor component.

aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication.

Astro prior to 6.1.10 used AES-GCM encryption for server island props and slots but did not bind ciphertext to its intended component or parameter type. An attacker could replay one component's encrypted props (p) as another component's slots (s) or vice versa; since slots contain raw unescaped HTML, this could lead to XSS. This occurs when the app uses server islands, two components share the same key name for a prop and a slot, and the attacker controls the overlapping prop value.

fast-xml-builder builds XML from JSON. Prior to 1.1.7, when input data has quotes in attribute values but process entities is not enabled, it breaks the attribute value into multiple attributes. This gives room for an attacker to insert unwanted attributes into the XML/HTML. This vulnerability is fixed in 1.1.7.

In fast-xml-builder 1.1.5, the fix for CVE-2026-41650 in fast-xml-parser sanitizes -- sequences in XML comment content using .replace(/--/g, '- -'). This skips values containing three consecutive dashes (e.g., --->...), allowing an attacker to break out of an XML comment and inject arbitrary XML/HTML content. This vulnerability is fixed in 1.1.6.