CVE Vulnerability Catalog

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, refresh tokens are not invalidated when the user's security_stamp is rotated by some security-sensitive operations (password change, KDF change, key rotation, email change, org admin password reset, emergency access takeover). This allows an attacker holding a previously obtained refresh token to maintain session access even after the user has taken action to secure their account. This vulnerability is fixed in 1.35.5.

Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers in optional Wireshark suite utilities. In 1.1.5 and earlier, wireshark-mcp exposes a wireshark_export_objects MCP tool that accepts an attacker-controlled dest_dir parameter and passes it to tshark's --export-objects flag with no mandatory path restriction. The path sandbox (_allowed_dirs) is None by default and only activates when the environment variable WIRESHARK_MCP_ALLOWED_DIRS is explicitly set. In a default installation, any directory on the filesystem can be used as the export destination.

Prior to 2.52.12 and 3.1.0, a Cross-Site Scripting vulnerability in Go Fiber allows a remote attacker to inject arbitrary HTML/JavaScript by supplying Accept: text/html on any request whose handler passes attacker-influenced data to the AutoFormat() feature. This vulnerability is fixed in 2.52.12 and 3.1.0.

A denial-of-service vulnerability in barebox prior to version 2026.04.0 allows attackers to cause an infinite loop during directory listing or path resolution by supplying a malicious ext4 filesystem image with a crafted directory entry containing a zero-length value.

A weakness has been identified in D-Link DIR-816 version 1.10CNB05_R1B011D88210. The function sub_445E7C of the file /goform/formDMZ.cgi is affected; this manipulation causes command injection. The attack can be initiated remotely, and the exploit has been made available to the public and could be used for attacks.

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values. The unvalidated inputs are the method and URI in the request line, the URL host that becomes the Host: header, and HTTP/1.1 control data field values. An attacker who controls one of these inputs, for example a user-supplied URL passed to a webhook or URL fetch endpoint, can inject additional headers and smuggle requests to the upstream server.

AVideo versions up to and including 29.0 have a vulnerability in plugin/PayPalYPT/agreementCancel.json.php where a PayPal billing agreement is canceled using an attacker-supplied agreement parameter without verifying ownership. A low-privilege authenticated user can silently suspend another user's recurring subscription.

In WWBN AVideo versions up to and including 29.0, the unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attacker-controlled title, description, and joinURL parameters into Scheduler::downloadICS(), which builds an ICS calendar file. ICS::escape_string() only escapes commas and semicolons and does NOT neutralize CR/LF, so attacker CRLF bytes inside a property value break out and inject arbitrary ICS lines, including END:VEVENT / BEGIN:VEVENT pairs that add entire attacker-controlled calendar events. Because the malicious .ics file is served from the victim's trusted AVideo origin, this enables high-credibility calendar phishing.

In AVideo versions up to and including 29.0, the objects/users.json.php endpoint exposes two unauthenticated paths that disclose the full set of registered user accounts. The isCompany request parameter bypasses the admin-only guard in User::getAllUsers()/User::getTotalUsers(), and a second path accepts users_id and calls User::getUserFromID() without any permission check. Both paths return IDs, display names, channel URLs, photos, backgrounds, statuses, and the total account count.

WWBN AVideo is an open source video platform. In versions up to and including 29.0, objects/sendEmail.json.php exposes two branches depending on whether contactForm=1 is submitted. When the parameter is omitted, the endpoint sets $sendTo to an attacker-supplied email and, for unauthenticated callers, uses the site's own contact email as the message From:/Reply-To:. The endpoint is explicitly allow-listed as a "public write action" in objects/functionsSecurity.php (line 885), so it requires no authentication or CSRF token. An unauthenticated attacker (solving a captcha) can force the site's own SMTP infrastructure to send attacker-composed emails to arbitrary recipients with the site's legitimate sender address, passing SPF/DKIM/DMARC for the site's domain — ideal for targeted phishing and brand impersonation. Commit 4e3709895857a5857f0edb46b0ee984de0d9e1a2 contains an updated fix.

AVideo versions up to and including 29.0 allow an authenticated user to configure a donation-notification webhook URL pointing to internal/loopback/metadata hosts. When another user donates, the server issues a curl POST to the attacker-supplied URL, resulting in blind SSRF. The handler uses only isValidURL() and does not call isSSRFSafeURL(), and CURLOPT_FOLLOWLOCATION is enabled without per-hop revalidation.

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a <script> block. An attacker who sends a victim to a crafted URL can break out of the string and execute arbitrary JavaScript in the victim's browser in the context of the AVideo origin. No authentication is required if a public Meet schedule exists on the target. Commit 3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b contains an updated fix.

In AVideo up to and including 29.0, objects/userSavePhoto.php accepts a base64 POST parameter and writes decoded bytes to the profile photo, with only User::isLogged() access control. There is no CSRF token, Origin/Referer check, or MIME validation, and the default SameSite=None; Secure cookie policy allows an attacker to overwrite a logged-in user's profile photo and trigger clearCache(true).

AVideo up to and including 29.0 passes the raw 'message' POST parameter into sendSiteEmail(), which substitutes it directly into an HTML email template without sanitization or output encoding. Any authenticated user with upload permission can broadcast arbitrary HTML (phishing links, tracking pixels, UI spoofing) to all channel subscribers, up to 10,000 recipients per invocation.

In AVideo versions up to and including 29.0, plugin/MobileManager/oauth2.php completes an OAuth login by redirecting to a URL containing the victim's stored password hash. Because the login endpoint accepts an encodedPass=1 flag that bypasses hashing, anyone who captures the redirect URL (via server logs, referrer leakage, or browser history) obtains a credential equivalent to the plaintext password and can fully take over the account, including admin accounts.

A vulnerability in barebox prior to version 2026.04.0 allows out-of-bounds reads during ext4 filesystem parsing. Missing validation of the eh_entries field against buffer capacity in fs/ext4/ext4_common.c enables attackers to supply a malicious ext4 image via USB, SD card, or network boot.

In barebox prior to version 2026.04.0, an out-of-bounds read vulnerability exists in the DHCP option parsing within the dhcp_message_type() function that fails to verify the options pointer remains within received packet bounds. An attacker on the same broadcast domain can send a crafted DHCP Offer or ACK packet without a proper 0xff end marker to cause the parser to read past valid packet data and potentially crash the system.

An out-of-bounds write issue was addressed with improved bounds checking. It affects iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5. An attacker on the local network may cause a denial-of-service.

A race condition was addressed with additional validation. The issue affects iOS, iPadOS, macOS, and visionOS and may allow an app to access sensitive user data.

Improved memory handling in iOS, iPadOS, macOS, and tvOS. An attacker on the local network may cause a denial-of-service.