CVE Vulnerability Catalog

A2A Java SDK prior to 1.3.0.Final allows a malicious or compromised remote agent to cause the default JDK-based client to forward a configured API key to a third-party server. AuthInterceptor uses APIKeySecurityScheme.name() from the remote AgentCard as the HTTP header name without checking that the declared location is HEADER, and JdkA2AHttpClient uses followRedirects(NORMAL), so an agent-controlled cross-origin redirect forwards the credential-bearing header.

The WordPress Meta Box – WordPress Custom Fields Framework plugin through 5.15.2 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may allow unauthorized users to perform restricted actions.

Apache CouchDB 3.5.2 and below insufficiently filters credentials in the _replicator database. An authenticated user can read replication credentials of other users' replications, not just their own.

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool or equivalent DTFJ code may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host.

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page.

In a memory-protected ThreadX module, a queue request reaches the Module Manager's dispatch layer, which passes a word count instead of a byte extent to the range check. This causes a privileged read of up to 3 * message_size bytes past the module's allowed memory, with the data written into the queue's message area.

The GUIX software JPEG decoder reads four kinds of marker segments without checking that each is long enough to hold what it reads. A truncated segment causes a read past the caller's image buffer, and a zero chroma sampling factor makes the block decode loop non-terminating.

_gx_binres_pixelmap_table_load() in the GUIX binary resource (theme) loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table, corrupting GUIX's own memory arena.

gx_binres_theme_load() and gx_binres_font_load() take the resource as a bare GX_UBYTE * with no length, and GX_BINRES_DATA_INFO has no field to carry one. A resource declaring more data than it contains is read past its end, and an offset stored in the file is turned into a pointer without being bounded.

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file placing a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has been allocated, and the decoder returns GX_SUCCESS and publishes a GX_PIXELMAP whose dimensions and data_size exceed the allocation.

In MinIO up to RELEASE.2025-10-15T17-29-55Z, the globalDeploymentID/SessionTokenAuthenticate function in cmd/common-main.go of the Embedded Console component uses a hard-coded cryptographic key. The attack can be launched remotely and the exploit has been publicly disclosed.

In Nerimity Desktop up to 2.2.2, the shell.openExternal function in src/mainWindow.js of the Window Open Handler component improperly authorizes handling of custom URL schemes. Manipulating the url argument allows the attack to be executed remotely, and the exploit has been made public.

launch-editor before 2.14.2 does not force a file path to be interpreted as a positional filename. If an attacker creates a file starting with a plus or minus in the working directory, the selected editor (Vim, gVim, MacVim, Emacs, Emacsclient, Notepad++ with a plugin) treats the attacker-controlled filename as a command-line flag, potentially causing unintended file overwrite or arbitrary command execution.

launch-editor before 2.14.2 did not escape % on Windows when passing an argument to cmd. If an environment variable contained a malicious value, that content could be executed.

In filelock from 3.22.0 until 4.2.1, SoftFileLock trusted a forged process identifier in a marker that an attacker could modify but not remove. This allowed an authorized contender such as another process of the holder's account or root to act as a confused deputy, remove the live marker, and admit another holder.

In filelock from 4.1.0 until 4.2.1, ReadWriteLock could remove a randomized .filelock-* private-hard-link directory during cleanup. Another local user with rename access in a non-sticky parent could observe a live name or forge a dead-owner sweep name and rename a sibling directory onto it for deletion.

In filelock from 3.20.4 until 4.0.9, ReadWriteLock and AsyncReadWriteLock resolved the lock path and passed it to SQLite without rejecting a final symbolic link. Another local user who can create names in the lock directory could redirect database creation and locking or split mutual exclusion between targets.

In filelock from 3.22.0 until 4.2.1, SoftFileLock could break a stale marker after an attacker freed its own marker following the stale read, an honest contender created a live successor on the reused inode, and the successor's modification time was not newer than the saved observation, causing the live marker to be removed and two holders to be admitted.

In filelock from 4.0.0 until 4.2.1, SoftReadWriteLock refreshed holder records by name. Another local user with rename access to the lock directory could replace a record with a named pipe and stall the lock, or under a permissive hard-link policy link a reachable target file and cause the lock user to write through it.

In filelock from 3.20.4 until 4.2.1, ReadWriteLock could open a crafted SQLite lock database without bounding schema and query work. Another local user who can replace the database could make acquisition stall or hang.