CVE Vulnerability Catalog

Yubico libfido2 before 1.17.0, python-fido2 before 2.2.0, and yubikey-manager before 5.9.1 have an unintended DLL search path. This may allow loading a malicious DLL from an inappropriate location.

Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity is High.

Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

ApostropheCMS versions 4.28.0 and prior contain a timing side-channel vulnerability in the password reset endpoint (/api/v1/@apostrophecms/login/reset-request) that allows unauthenticated username and email enumeration. Response time differences arise from lack of delay normalization and rate limiting. The issue is fixed in version 4.29.0.

A cross-tenant isolation vulnerability was found in Grafana's Correlations feature affecting legacy correlation records. Due to a backward compatibility condition allowing org_id = 0 records to be returned across organizations, a user with datasource management privileges could read and permanently delete legacy correlation data belonging to another organization. This issue affects correlations created prior to Grafana 10.2 and is fixed in >=11.6.11, >=12.0.9, >=12.1.6, and >=12.2.4.

Weblate is a web based localization tool. In versions prior to 5.17, the tasks API didn't verify user access for pending tasks. This could expose logs of in-progress operations to users who don't have access to given scope. The attacker needs to brute-force the random UUID of the task, so exploiting this is unlikely with the default API rate limits.

HCL AION is affected by a vulnerability where certain system behaviours may allow exploration of internal filesystem structures. Exposure of such information may provide insights into the underlying environment.

A regression introduced in OAuth2 Proxy 7.11.0 prevents clearing the session cookie when rendering the sign-in page. In deployments relying on the sign-in page as part of the logout flow, a user may be shown the sign-in page while the existing session cookie remains valid, meaning the browser session is not actually logged out. On shared workstations, a subsequent user could continue the previous user's authenticated session. This is fixed in version 7.15.2.

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.

ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit this vulnerability and exhaust system resources, reducing application speed. Exploitation of this issue does not require user interaction.

Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4 all versions, and FortiSandbox PaaS 5.0.1 through 5.0.5 contain an insufficiently protected credentials vulnerability. An authenticated administrator may read LDAP server credentials via client-side inspection.

Fortinet FortiNAC-F (7.6.0–7.6.5, 7.4 all versions, 7.2 all versions) contains an Open Redirect vulnerability (CWE-601). A remote privileged attacker with system administrator role can redirect users to an arbitrary website via a crafted CSV file.

A vulnerability in Siemens products allows an unauthenticated remote attacker to perform man-in-the-middle attacks due to improper validation of client certificates when connecting to the Analytics Service endpoint.

MaxKB is an open-source AI assistant for enterprise. In versions 2.7.1 and below, an authenticated user can bypass sandbox result validation and spoof tool execution results by exploiting Python frame introspection to read the wrapper's UUID from its bytecode constants, then writing a forged result directly to file descriptor 1 (bypassing stdout redirection). By calling sys.exit(0), the attacker terminates the wrapper before it prints the legitimate output, causing the MaxKB service to parse and trust the spoofed response as the genuine tool result.

SAP Landscape Transformation contains a vulnerability in an RFC-exposed function module that could allow a high-privileged adversary to inject arbitrary ABAP code and operating system commands. This could result in modification of some information, though the attacker does not control the kind or degree of change.

Craft Commerce versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4 disclose order data to unauthenticated users when an order number is provided and the email check fails during anonymous payment. The JSON error response includes the serialized order object with sensitive fields such as customer email and shipping/billing addresses. Fixed in versions 4.11.0 and 5.6.0.

Vulnerability in uclouvain openjpeg up to 2.5.4, in the function opj_pi_initialise_encode in src/lib/openjp2/pi.c. The manipulation leads to an integer overflow; the attack must be carried out locally, and the exploit is publicly available.

A weakness was identified in code-projects Simple Content Management System 1.0 in an unknown part of /web/admin/welcome.php. Manipulating the News Title argument leads to cross site scripting. The attack can be executed remotely and the exploit is publicly available.

A vulnerability in MaxKB up to 2.4.2, affecting an unknown function in the file ui/src/chat.ts of the MdPreview component, allows cross-site scripting (XSS). The attack can be executed remotely. Upgrading to version 2.5.0 is recommended.

Improper access control in Samsung Camera prior to version 16.5.00.28 allows a local attacker to access location data. User interaction is required to trigger the vulnerability.