CVE Vulnerability Catalog

draw.io is a configurable diagramming and whiteboarding application. Prior to version 29.7.9, the draw.io client accepts a ?gitlab= URL parameter that overrides the GitLab server URL used during OAuth sign-in. A crafted link causes the user's click on draw.io's "Authorize in GitLab" dialog to open a popup on the attacker-controlled host instead of gitlab.com, which can lead to credential phishing and session state token exfiltration. This issue has been patched in version 29.7.9.

Dell PowerScale OneFS versions 9.5.0.0 through 9.5.1.6, 9.6.0.0 through 9.7.1.13, 9.8.0.0 through 9.10.1.5 and 9.11.0.0 through 9.12.0.1 contains an Insufficient Logging vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

In OpenStack Ironic before version 35.0.2, in a certain configuration, the instance 'instance_info['ks_template']' is rendered without proper sandboxing.

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0 affecting an unknown part of the file /index.php?page=users. Manipulation of the Name argument can lead to cross-site scripting. The attack may be launched remotely, and the exploit has been published and may be used.

An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms and obtain restricted touchpad information or render the touchpad unusable via crafted IOCTL requests.

A weakness was identified in OSGeo GDAL up to 3.13.0dev-4 affecting the GDfieldinfo function in frmts/hdf4/hdf-eos/GDapi.c. The manipulation can lead to an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 fixes the issue.

A vulnerability was determined in OSGeo GDAL up to 3.13.0dev-4 affecting the memmove function in frmts/hdf4/hdf-eos/SWapi.c of the HDF-EOS Grid File Handler component. The manipulation causes an out-of-bounds read. The attack requires local execution, and the exploit has been publicly disclosed. Upgrading to version 3.13.0RC1 resolves the issue.

Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. The vulnerability may lead to abnormal behavior or a process crash.

Tor before 0.4.9.7 has a NULL pointer dereference when a CERT cell is received out of order (TROVE-2026-006).

Tor before 0.4.9.7, when circuit queue memory pressure exists, can experience a client crash because of a double close of a circuit (TROVE-2026-009).

Tor before 0.4.9.7 mishandles accounting of the conflux out-of-order queue during the clearing of a queue, aka TROVE-2026-010.

Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via conflux legs, aka TROVE-2026-008.

Tor before 0.4.9.7 has an out-of-bounds read when an END, TRUNCATE, or TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011.

Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted MHTML page.

Side-channel information leakage in Media in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Insufficient validation of untrusted input in CORS in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.

Insufficient validation of untrusted input in SiteIsolation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page (severity: Medium).

Insufficient validation of untrusted input in DevTools in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page (severity: Medium).

Inappropriate implementation in Navigation in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page (severity: Medium).

A race in Shared Storage in Google Chrome before 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page (Chromium severity: Medium).