CVE Vulnerability Catalog

An out-of-bounds access issue was addressed with improved bounds checking. Parsing a maliciously crafted file may lead to an unexpected app termination.

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

Improved file handling in macOS prevents a maliciously crafted ZIP archive from bypassing Gatekeeper checks.

A vulnerability in WebKit allows a process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.

A vulnerability in WebKit allows a process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.

A vulnerability in WebKit allows a process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.

Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) have a buffer overflow addressed with improved input validation. A local user may be able to cause unexpected system termination or read kernel memory.

A race condition was addressed with additional validation in macOS Tahoe 26.4. Before the fix, an app could access sensitive user data.

An out-of-bounds write issue was addressed with improved bounds checking. The issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, macOS Sequoia 15.7.7, macOS Sonoma 14.8.7, and macOS Tahoe 26.5. An app may be able to execute arbitrary code with kernel privileges.

An authorization issue was addressed with improved state management. Fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.4. An app may be able to access sensitive user data.

A security vulnerability has been detected in jishenghua jshERP up to 3.6. This affects the function getUserByWeixinCode of the file jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java of the component updatePlatformConfigByKey Endpoint. Such manipulation of the argument weixinUrl leads to server-side request forgery. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in aiwaves-cn agents up to e8c4e3c2d19739d3dff59e577d1c97090cc15f59. Affected by this issue is the function recall_relevant_memories_to_working_memory of the file core/cat/looking_glass/stray_cat.py of the component cheshire_cat_core. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project was informed of the problem early through an issue report but has not responded yet.

Amazon::Credentials versions through 1.2.0 for Perl use the rand function to generate encryption keys. Before version 1.3.0, secrets were encrypted using a 64-bit key generated by the built-in rand function, which is predictable and unsuitable for cryptography.

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the Processo de Aceitação (html/atendido/processo_aceitacao.php) page, which is executed when a user accesses the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.

WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, a Stored Cross-Site Scripting (XSS) vulnerability allows an authenticated user to inject malicious JavaScript into the "Etapas de um Processo" (html/atendido/etapa_processo.php) page, which is executed when a user accesses the page, enabling session hijacking and account takeover. This vulnerability is fixed in 3.7.3.

Prior to 2.33.0, a stored cross-site scripting (XSS) vulnerability exists in the Login Page due to improper sanitization of the authLoginCustomMessage field of the /api/auth-settings endpoint. An attacker with administrative privileges can inject arbitrary HTML/JavaScript that will be rendered on the login page for all users. This vulnerability is fixed in 2.33.0.

In Audiobookshelf prior to 2.32.2, the POST /api/backups/upload endpoint decompresses the details entry from an uploaded .audiobookshelf ZIP file entirely into memory using zip.entryData(), with no limit on decompressed size. The upload middleware also has no file size limit, so an admin user can upload a crafted ZIP containing a highly compressed details entry that, when decompressed, consumes hundreds of megabytes or gigabytes of memory, crashing the server process via out-of-memory. This vulnerability is fixed in 2.32.2.

In Audiobookshelf prior to 2.32.2, the POST /api/filesystem/pathexists endpoint uses String.startsWith() to validate that a resolved file path is within a library folder. The check fails for sibling directories sharing a common name prefix (e.g., /audiobooks vs /audiobooks-private), allowing authenticated users with upload permission to probe file existence outside their authorized library folder boundaries.

Audiobookshelf prior to 2.32.2 returns collections from all libraries via GET /api/collections and GET /api/collections/:id without verifying user access to each collection's library. An authenticated user with access to any library can enumerate and read collections (including full book metadata) from libraries they are explicitly restricted from.

In Audiobookshelf prior to 2.32.2, the GET /api/libraries/:id/download endpoint validates that the requesting user has access to the library specified in the URL path, but fetches downloadable items solely by attacker-provided IDs without constraining them to that library. An authenticated user with download permission and access to any one library can exfiltrate the full file contents of items belonging to any other library, including libraries they are explicitly denied access to.