CVE Vulnerability Catalog

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v2. A local attacker can corrupt heap memory via integer wraparound in bitmap size calculation by supplying a crafted v2 persistent cache file with oversized width and height values.

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m). The audio queue buffer size is computed as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU, causing the multiplication to wrap and undersized AudioQueueAllocateBuffer allocations, leading to a heap out-of-bounds write in macOS and iOS clients.

FreeRDP before 3.32.0 contains a heap buffer overflow vulnerability in persistent_cache_read_entry_v3. A local attacker can corrupt memory by supplying a crafted v3 persistent cache file with large width and height values that wrap the size calculation in persist_cache_get_data, causing fread to overflow an undersized buffer.

FreeRDP from 3.0.0 before 3.32.0 contains an uncontrolled resource consumption vulnerability in parse_nla_mode_pdu. An unauthenticated attacker can exhaust server memory by completing TLS and streaming bytes not beginning with the DER SEQUENCE tag 0x30, causing unbounded receive buffer growth before NLA authentication.

A hard-coded cryptographic key vulnerability exists in /usr/bin/sysman of some Moxa industrial computing products. An unauthenticated attacker with adjacent network access could exploit the exposed private key material to compromise the confidentiality and integrity of communications.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.

A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market. It could allow a local authenticated user to execute arbitrary code with elevated privileges.

A flaw was found in WildFly. A user with the Monitor role, the lowest standard RBAC role, can exploit a path traversal vulnerability in the take-snapshot operation. By manipulating the name parameter, this user can write a copy of the server configuration to an arbitrary location, allowing the Monitor role to read back the server configuration, including sensitive credentials, leading to information disclosure.

A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market. An attacker on the same logical network could exploit it to execute arbitrary code.

A vulnerability was found in bitcoinj up to 0.17 in the url.openConnection function of PaymentSession.java within the Payment Request Handler component. Manipulating the pki_type argument can lead to server-side request forgery, exploitable remotely, and the exploit has been publicly disclosed.

ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId routes that allows any course member, including students, to modify lessons. Authenticated students can supply arbitrary lesson IDs to change titles and stored HTML content or delete lessons in their course and in other courses and organizations.

cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user IDs. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts.

CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities and the gift_key, then call receive_gift to redirect paid goods to their address.

MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.

ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin REST API endpoint because Auth::check() fails open when no admin_api rule exists. Attackers with a valid admin-type API token can list member emails and mobile numbers, disable members, and call PUT admin/roles/{id}/authorize to grant themselves full administrator rights.

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by ID without session or authorId checks. Unauthenticated attackers who know a HealthData record ID can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.

Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check. Attackers can send a short RequestFileTransfer (SID 0x38) request with filePathAndNameLength 0xFFFC-0xFFFF, causing callbacks to read past the receive buffer, crashing targets or disclosing memory.

snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an unchecked DataLength field. Rogue or impersonated PLCs can return crafted ReadVar responses causing memcpy of up to 65535 bytes into caller buffers, crashing SCADA, HMI, or gateway processes and corrupting memory.

Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRANDFIELD, ZRANDMEMBER or SRANDMEMBER. Attackers can send a single command against a one-element key with a huge negative COUNT to trigger the OOM killer, terminating the instance for all clients.