CVE Vulnerability Catalog

A use-after-free (UAF) vulnerability exists in the kernel module. Successful exploitation may affect availability and confidentiality.

Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure. This issue affects Escargot commit 97e8115ab1110bc502b4b5e4a0c689a71520d335.

An out-of-bounds read vulnerability in Samsung's open source Escargot library allows resource leak exposure. The issue affects the specific Escargot revision 97e8115ab1110bc502b4b5e4a0c689a71520d335.

Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the restrictions.

A double free vulnerability exists in the multi-mode input system. Successful exploitation may affect availability.

The memo module contains an access control vulnerability. Successful exploitation affects availability and confidentiality.

Stack overflow vulnerability in the media platform. Successful exploitation of this vulnerability may affect availability.

The theme setting module contains an improper permission control vulnerability. Successful exploitation may affect service confidentiality.

A Stored Cross-Site Scripting (XSS) vulnerability in the NightWolf Penetration Testing Platform allows an attacker to inject and execute a malicious script in the user's browser.

A vulnerability has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /checkupdatestatus.php. Manipulation of the serviceId argument leads to cross-site scripting. The attack can be initiated remotely and the exploit has been disclosed to the public.

A security flaw was discovered in farion1231 cc-switch up to version 3.12.3 in the ProxyServer component (file src-tauri/src/proxy/server.rs). Manipulation leads to a permissive cross-domain policy with untrusted domains. The exploit has been publicly released and can be used for remote attacks.

In danielmiessler Personal_AI_Infrastructure up to 2.3.0, an unknown function in Skills/Parser/Tools/parse_url.ts allows OS command injection. The attack can be launched remotely and the exploit has been publicly disclosed.

Podatność związana z deserializacją niezaufanych danych w Samsung Open Source Escargot Java Script może prowadzić do stanu odmowy usługi poprzez przerwanie procesu. Problem dotyczy wersji escargot przed commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335.

Varnish Cache 9 before 9.0.1 allows a "workspace overflow" denial of service (daemon panic) after timeout_linger. A malicious client could send an HTTP/1 request, wait until the session releases its worker thread (timeout_linger), and resume traffic before the session is closed (timeout_idle) by sending more than one request at once to trigger pipelining and workspace overflow. The vulnerability stems from a porting error of the non-blocking architecture from Varnish Enterprise.

Varnish Enterprise before 6.0.16r12 allows a "workspace overflow" denial of service (daemon panic) for shared VCL. The headerplus.write_req0() function from vmod_headerplus updates req0; if the amended req contains too many header fields, it can cause a workspace overflow and crash the server.

Varnish Cache 9 before 9.0.1 and Varnish Enterprise before 6.0.16r11 allow a "workspace overflow" denial of service (daemon panic) for certain amounts of prefetched data. During HTTP/2 upgrade, a buffer allocation splits the workspace, and the next fetch may run out of workspace.

A security flaw has been discovered in Dromara warm-flow up to 1.8.4. The SpelHelper.parseExpression function in /warm-flow/save-json of the Workflow Definition Handler component is affected; manipulation of the listenerPath/skipCondition/permissionFlag arguments results in code injection. The attack may be performed remotely and the exploit has been released publicly.

A vulnerability was identified in AstrBotDevs AstrBot up to 4.22.1. The affected element is the post_data.get function of the API Endpoint component. Such manipulation leads to server-side request forgery. The attack may be performed remotely and the exploit is publicly available. The project was informed but has not responded.

A vulnerability was found in AstrBotDevs AstrBot up to 4.22.1 in the add_mcp_server function of astrbot/dashboard/routes/tools.py within the MCP Endpoint component. Manipulation of the command argument causes command injection, and the attack can be carried out remotely. The exploit has been publicly disclosed and may be utilized; the project was informed but has not responded.

In AstrBot up to 4.22.1, the install_plugin_upload function in astrbot/dashboard/routes/plugin.py (install-upload endpoint) mishandles the File argument, resulting in a sandbox issue. The vulnerability can be exploited remotely and the exploit has been publicly disclosed.